Introduction
This Security Policy describes how to report vulnerabilities and the security practices for the VC desktop and mobile applications, the hosted application at https://app.vce.codes, the account portal at https://portal.vce.codes, the optional VC Connect service, and the VC website at https://vce.codes.
VC connects software running on your devices and in environments you control with coding-agent harnesses and providers you choose. We secure the software and infrastructure that VC operates, but we do not control the security of your devices, environments, repositories, networks, credentials or third-party providers. Please keep the shared responsibilities below in mind when assessing risk.
Reporting security issues
If you believe you have found a security vulnerability in VC or VC-operated infrastructure, email [email protected]. Please do not disclose the issue publicly until we have had a reasonable opportunity to investigate and fix it.
Please include, when available:
- A description of the issue and its potential impact;
- The affected application, version, URL, endpoint or component;
- Clear reproduction steps or a minimal proof of concept;
- Relevant logs, screenshots, or request and response details, with secrets removed; and
- How to contact you, and whether you would like public credit.
We aim to acknowledge complete reports promptly, keep reporters informed of material progress, and coordinate disclosure once a fix is available. Resolution time depends on severity, complexity and any dependencies on third parties.
Responsible research and safe harbor
We support good-faith security research. If you make a genuine effort to follow this policy, avoid harm, respect privacy and report findings promptly, we will treat your research as authorized and will not take legal action against you for accidental, good-faith violations of this policy. If a third party takes legal action over compliant research, we will make our authorization known where appropriate.
To stay within this safe harbor, you must:
- Test only accounts, data and systems you own or have explicit permission to test;
- Stop and report immediately if you encounter personal, confidential or production data;
- Access only the minimum information needed to demonstrate the issue;
- Avoid disrupting availability, degrading performance, or damaging or deleting data;
- Not use social engineering, phishing, physical attacks or denial-of-service testing;
- Not test third-party services or infrastructure outside VC’s control; and
- Give us reasonable time to address the issue before any public disclosure.
This safe harbor does not authorize violations of law or activity outside the scope of this policy. Vulnerability rewards are not guaranteed and, if offered, are at our discretion.
Our security practices
We use administrative, technical and organizational safeguards suited to the nature of VC and the information VC-operated services process. They include:
- Data minimization. VC is designed so coding-session content can stay between your clients, your environment, and the harnesses and providers you configure. We process information through VC-operated infrastructure only when a feature you enable needs it.
- Encrypted transport. VC-operated network services use encrypted transport. Connection flows use scoped credentials and single-use pairing tokens to reduce unauthorized reuse.
- Account protection. Email and password sign-ins require a one-time code sent by email, and you can review and end signed-in sessions in the account portal.
- Credential protection. VC uses the platform’s protected storage for credentials and session tokens where available, and hides secret values after you save them. We design operational logging to avoid collecting secrets that are not needed to run or troubleshoot the Services.
- Access controls. Access to production systems and operational data is limited by job responsibility and protected by authentication and authorization controls.
- Maintenance and monitoring. We monitor VC-operated services for reliability and security events, review dependencies, and deploy updates and mitigations as appropriate.
No system is completely secure. These practices reduce risk but do not guarantee that the Site or the Services will be free from vulnerabilities or unauthorized access.
Your responsibilities
Because you control much of the VC execution path, you play an important role in securing it. You are responsible for:
- Keeping VC, your operating systems and connected tools up to date;
- Securing your devices, repositories, environments, networks and backups;
- Protecting account, provider, repository and environment credentials;
- Using multi-factor authentication where your identity and coding-agent providers support it;
- Choosing permission modes that fit the work, and granting providers and integrations only the access they need;
- Reviewing commands, source changes and other agent output before applying or executing them;
- Removing lost or unused devices and revoking credentials you believe may be compromised; and
- Following the security policies of your selected harnesses, providers and infrastructure.
Do not send passwords, API keys, access tokens or private keys in a vulnerability report. Revoke any secret that may have been exposed before sharing sanitized evidence with us.
Updates to this policy
We may update this Security Policy as VC, our infrastructure and our security practices evolve. We will post revisions at this address and update the dates above. Material changes to the reporting process or safe-harbor terms apply going forward.
Contact us
Report security issues or ask security questions at [email protected]. For general legal questions, contact [email protected]. For privacy requests, contact [email protected].