Security

We build Vigil to the standard we hold your apps to. Here's how we protect your data and how to reach us about a vulnerability.

How scans work

Vigil reads only publicly available responses from the URL you give it. It never runs destructive tests, brute-forcing or load testing, and it refuses to scan private or internal network addresses.

Your data

• Secrets we detect are masked and never stored in raw form.
• All traffic is encrypted in transit (HTTPS).
• Database access is protected with Row Level Security, so you can only ever read your own data.
• Payments run through Stripe; we never handle card numbers.

Responsible disclosure

Found a security issue in Vigil itself? Please email security@vigilsec.app. We'll acknowledge within 72 hours and work with you on a fix. Please don't disclose publicly until we've resolved it. Our machine-readable policy lives at /.well-known/security.txt.