vibe

# Security Policy ## Reporting a Vulnerability If you discover a security vulnerability in /vibe, please report it responsibly. **Email:** security@slashvibe.dev Please include: - Description of the vulnerability - Steps to reproduce - Potential impact We will acknowledge receipt within 48 hours and aim to provide a fix or mitigation plan within 7 days. ## Scope This policy covers the `slashvibe-mcp` npm package and the [VibeCodingInc/vibe-mcp](https://github.com/VibeCodingInc/vibe-mcp) repository. ## Supported Versions | Version | Supported | |---------|-----------| | 0.2.x | Yes | | < 0.2 | No | ## Security Design - **Identity**: GitHub OAuth — no passwords stored - **Messages**: Synced via HTTPS to slashvibe.dev API - **Local storage**: SQLite database at `~/.vibecodings/sessions.db` - **Memory**: Notes about people are stored locally only — never sent to the server - **No telemetry**: /vibe does not collect usage analytics