Security

Security reports are welcome. Please use GitHub's private vulnerability reporting so details are not disclosed publicly before a fix is available.

What to include

Describe the affected page or component, the impact, and steps to reproduce. Do not include live credentials, personal information, or data obtained from other users. A report will be acknowledged and assessed as soon as practical.

Built-in protections

• Sign-in uses verified email addresses from GitHub or Google.
• Session cookies are secure, HTTP-only, and protected with signed values.
• Personal access tokens are shown once and stored only as cryptographic hashes.
• Payments are handled by Stripe; VibeSense does not store card details.

For non-sensitive support questions, use the contact form. The public source is available on GitHub.