PENTESTS
Quarterly external pentests.
Every quarter, an independent CREST-certified team runs a black/grey-box pentest against production. Findings drive sprint priority — not a footnote in the next audit.
SECURITY
We secure VibeReview the way we tell you to secure your code.
VibeReview is built by we45 — an AppSec services company that's been threat-modelling and pentesting other people's software since 2011. We hold ourselves to the same playbook we ship to your engineers.
14-day free trial · No card required
SSDLC
SAST + SCA on every PR.
Static analysis on every diff. Software composition analysis on every dependency bump. Threat models reviewed at every architecture change. The same gating layers we sell.
DOGFOOD
VibeReview reviews VibeReview.
Our own threat-informed guardrails ride every commit our engineers push. If a rule doesn't catch our own mistakes, it doesn't ship to you either.
EPHEMERAL
Born per request, dies after.
Profiling jobs and threat-model runs spin up in per-request compute, do their work, and are torn down. No persistent worker pool sitting on customer state between sessions.
EGRESS
Restricted egress.
Workloads don't have general internet access. Outbound calls go through an allow-list of specific endpoints we own — the AI provider, our object store, our database.
NO SHELL
No operator shells into your job.
No VibeReview engineer can attach a shell to a running customer workload. There is no kubectl exec path. Debugging happens through structured logs and traces only.
AUTHN
Zitadel-backed authentication.
Authentication runs on Zitadel — production identity infrastructure, not a homegrown user table. Individual accounts can sign in with email, Google, GitHub, or Microsoft.
RBAC
Granular role-based access.
Roles scoped to organisations, projects, and resources. Engineers, reviewers, billing admins, and owners each see exactly what their role permits — nothing more.
SSO
SSO, SCIM, SAML.
Enterprise tier supports SAML 2.0 SSO, SCIM 2.0 provisioning, and group-mapped role assignment. Bring your own IdP — Okta, Entra ID, Auth0, Ping, JumpCloud, OneLogin.
ENCRYPTION
Encrypted at rest.
Sensitive fields — OAuth tokens, integration secrets, webhook signing keys, customer-supplied policy data — are encrypted at rest with envelope encryption and KEKs rotated on a documented cadence.
ISOLATION
Tenant + row-level security.
Every row in our database carries an organisation ID. Application-layer policy plus row-level security in the database enforce tenant boundaries on every query. No shared-table leaks, no "oops we forgot the WHERE" class of bug.
AUDIT
Read-only audit trail.
Every privileged action — config change, integration connect, member invite, role escalation, token issue — writes to an append-only audit log. Read-only by design. Exportable to your SIEM on Enterprise.
GITHUB
GitHub App, not PATs.
Installations issue short-lived installation tokens scoped to the repos you select. No personal access tokens to rotate or leak. Revoke the installation in GitHub and access dies in seconds.
GITLAB
GitLab App with scoped OAuth.
OAuth integration with explicit scopes per repo. Tokens refresh through GitLab's own flow; you can revoke from your GitLab account at any time. No long-lived PATs sitting in our database.
SOURCE
Code read transiently, never stored.
Source is read into ephemeral compute during profiling and discarded when the job ends. Only derived artifacts — threat models, guardrails, OWASP/CWE mappings — are persisted. Your repository is not on our disk.
COMPLIANCE
SOC 2 Type II · ISO 27001 certified.
Independently audited controls for security, availability, and confidentiality. Trust report, sub-processor list, and current pentest letter available on request.
SOC 2 Type II and ISO 27001 certified.
Independently audited controls for security, availability, and confidentiality. Request our trust report →
Have a question we didn't answer here?
Talk to our team — security, compliance, procurement, or vendor risk.