Security.

What protects your code and data today, in VibeHard 2.0.1, and what is still coming. We would rather tell you less than tell you something untrue.

Today: the Community Edition on your machine

— The factory runs on your own Mac or Linux machine. It makes no calls to AI model providers itself; a network guard in the background service blocks them. Your code goes only to the model provider your own agent uses.
— On Linux, generated code is built and tested in a sandbox with no network except for dependency installs. On Mac the sandbox blocks network and limits writes but does not yet isolate reads. If no sandbox is available, the build says so.
— Every full build runs the 44-gate chain, including secret scanning (a leaked secret always blocks), static analysis, dependency vulnerability checks and, for projects with tenant data, a check that a cross-tenant read is actually denied.
— Releases are signed, and the updater verifies the signature before installing anything and refuses downgrades.
— Snapshots before each build and after each successful repair let you roll back.

— Each company’s workflows in a workspace of their own, with a dedicated hardware-encrypted, attested enclave after our pilot.
— Steps that move money, post to your books, send outbound messages or delete data wait for a named person’s passkey approval.
— Credentials kept in AgentVault, our encrypted secrets vault, and added to approved calls, so your agents do not handle the keys.

— VibeHard is not SOC 2 audited. Custom and compliance gates are checks, not certifications.
— Do not send health records, card numbers or other regulated data to any VibeHard service today.
— No hosted customer environment is live yet.