Vibe Check Security Overview And Vulnerability Disclosure Policy

Last Updated: [EFFECTIVE DATE]

This document summarizes the technical and organizational measures that Tailored Surveys, Inc. ("Tailored Surveys," "we," "us," or "our") maintains for Vibe Check (the "Service") and sets out the terms on which security researchers may report vulnerabilities. It is provided for informational purposes, does not form part of any contract, and does not expand any warranty given in the Vibe Check Terms of Service.

1.ARCHITECTURE.

1.1Components. The Service consists of a single web application that serves (a) the pages through which a user creates an account, gives consent, and completes the Survey; (b) a REST interface and a Model Context Protocol ("MCP") interface, each exposing the same three operations to an authorized Agent; and (c) an OAuth 2.0 authorization server.

1.2Hosting and Data Location. The application and its database are hosted by Fly.io, Inc. in a single region in the United States. Domain name service is provided by Cloudflare, Inc. in resolution-only mode; Service traffic does not transit Cloudflare.

1.3Data Minimization by Design. The interfaces available to an Agent permit it only to read Survey questions, submit Agent Predictions, and read Results. No interface accepts or requests conversation content, memory, files, or other data from an Agent Platform, and the Service initiates no outbound connection to any Agent Platform.

1.4No Third-Party Code in the Browser. The Service loads no third-party scripts, fonts, analytics, or tracking technologies.

2.DATA PROTECTION.

2.1Encryption in Transit. All traffic is served over TLS, and plaintext HTTP requests are redirected to HTTPS.

2.2Encryption at Rest. The database resides on a storage volume encrypted at rest by our hosting provider.

2.3Credential Storage. Passwords are stored solely as salted scrypt hashes. API Keys, access tokens, refresh tokens, and authorization codes are stored solely as SHA-256 hashes and are displayed to the user, or returned to the client, exactly once.

2.4Deletion. All user-owned records are bound to the account record by cascading foreign-key constraints, such that deletion of an account removes every associated record in a single transaction. The database is configured to overwrite deleted content.

2.5Separation of Responses. A single server-side control prevents the disclosure of a user's Survey Responses, an Agent's Agent Predictions, or any measure of agreement between them until both have been completed. Submissions are insert-only and cannot be modified. Automated tests verify these properties on every change.

3.ACCESS CONTROL.

3.1User Authentication. Users authenticate with an email address and a password of at least ten (10) characters. Sessions are maintained by a signed, HTTP-only, same-site cookie transmitted only over TLS. State-changing forms are protected against cross-site request forgery.

3.2Agent Authorization. An Agent authenticates with a bearer credential that is either an API Key generated by the signed-in user or an OAuth 2.0 access token obtained through the authorization-code grant with Proof Key for Code Exchange (S256). Access tokens expire after one (1) hour; refresh tokens expire after thirty (30) days and are rotated on each use; authorization codes expire after ten (10) minutes and are single-use. Redirect URIs must be registered in advance, are matched exactly, and must use HTTPS or a loopback address.

3.3Scope of Agent Credentials. A credential issued to an Agent cannot be used to sign in to the website, to read the user's Survey Responses before completion, to alter consent, or to delete the account. Account deletion requires the user's password.

3.4Revocation. A user may revoke any credential from the account page with immediate effect. Deletion of the account revokes all credentials.

3.5Administrative Access. Administrative interfaces require a separate secret, are disabled when that secret is not configured, and return only pseudonymous numeric identifiers and never email addresses. [Access to production infrastructure is limited to a single named administrator and is protected by multi-factor authentication.]

4.APPLICATION SECURITY.

4.1Rate Limiting. Authentication endpoints are rate-limited by Internet Protocol address, and Agent interfaces are rate-limited by account.

4.2Input Handling. All database access uses parameterized statements. Request bodies submitted through the Agent interfaces are validated against typed schemas, and form submissions are validated server-side. Post-authentication redirects are restricted to same-origin paths.

4.3Response Headers. Web responses carry headers that prohibit framing and content-type sniffing and restrict referrer disclosure.

4.4Secrets. Application secrets are supplied through the hosting provider's secret store and are never committed to source control or written to logs.

4.5Testing. An automated test suite, including tests of the controls described in Sections 2.4, 2.5, and 3, is maintained and is run before each release.

5.INFORMATION SECURITY PROGRAM.

5.1Standard. Our safeguards are designed to satisfy the requirement of Section 899-bb of the New York General Business Law (the "SHIELD Act") to maintain reasonable administrative, technical, and physical safeguards, scaled to the size and complexity of our business and the sensitivity of the information we hold, and, to the extent applicable, Article 32 of Regulation (EU) 2016/679 and its United Kingdom counterpart (together, the "GDPR").

5.2Administrative Safeguards. We have designated [NAME OR TITLE] to coordinate the program. We identify reasonably foreseeable internal and external risks, assess the sufficiency of the safeguards in place to control them, [and review that assessment at least annually and upon any material change to the Service]. We select service providers capable of maintaining appropriate safeguards and bind them by contract to do so, including, where the GDPR applies, by terms satisfying Article 28. [Each person with access to production systems receives security and privacy training upon engagement and annually thereafter.]

5.3Technical Safeguards. The technical safeguards are described in Sections 1 through 4.

5.4Physical Safeguards and Disposal. We operate no physical servers; physical security of the hosting environment is the responsibility of our hosting provider under its own certifications. We dispose of Personal Information by deletion in accordance with the Data Deletion and Retention Policy, such that it cannot be read or reconstructed from production systems.

6.INCIDENT RESPONSE.

6.1Response. Upon becoming aware of a security incident we will contain and investigate it, preserve relevant records, and document the facts, effects, and remedial action taken.

6.2Notification. Where Personal Information is affected, we will notify affected individuals and the appropriate authorities as and when required by applicable law, including: (a) where the SHIELD Act applies, notification to affected New York residents within thirty (30) days of discovery, together with notification to the New York Attorney General, the New York Department of State, and the New York State Police; (b) notification under the breach-notification statute of each other state in which an affected individual resides; and (c) where the GDPR applies, notification to the competent supervisory authority without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach, and to affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

6.3Agent Platforms. [We will notify the provider of an Agent Platform of any incident affecting its users where required by that provider's terms.]

7.VULNERABILITY DISCLOSURE POLICY.

7.1Reporting. Please report suspected vulnerabilities to [SECURITY EMAIL] with a description sufficient to reproduce the issue. We will acknowledge receipt within five (5) business days.

7.2Authorization and Safe Harbor. If you make a good-faith effort to comply with this Section 7, we will consider your research to be authorized, will not initiate or support legal action against you in respect of it, and will work with you to understand and resolve the issue promptly.

7.3Rules of Engagement. You will: (a) test only against accounts that you own; (b) not access, modify, or delete the data of any other person and, if you encounter such data, cease testing and report immediately; (c) not perform denial-of-service testing, social engineering, or physical testing; (d) not use automated scanners in a manner that degrades the Service; and (e) allow us a reasonable period, and in any event not less than ninety (90) days, to remediate before any public disclosure.

7.4Scope. This Section 7 applies to https://vibes.tailoredsurveys.com only. It does not apply to any other property of Tailored Surveys, to our service providers, or to any Agent Platform, each of which must be reported to its own operator.

7.5No Bounty. We do not currently offer monetary rewards. With your permission we will credit your contribution.