VibeTrader Security

Where your data lives

• Web app — served from Netlify’s global CDN over HTTPS.
• API — runs on Google Cloud Run in Google’s us-central1 region.
• Database — Google Cloud Firestore. Google encrypts stored data at rest by default.
• Secrets — encryption keys and third-party credentials are held in Google Secret Manager, never in our source code.
• In transit — traffic between your browser or app and our services is encrypted with TLS.

Brokerage credentials

• Encrypted before storage — brokerage credentials are encrypted with Fernet (AES-128-CBC for confidentiality plus HMAC-SHA256 for integrity) before they are written to Firestore. The encryption key is held in Google Secret Manager and is not stored alongside the data.
• OAuth where your broker supports it — connections to Alpaca, Coinbase, Tradier and Charles Schwab use OAuth, so we never see your brokerage password. Brokers without an OAuth flow are connected with API keys you create and can revoke.
• Never logged — credentials are not written to logs or error reports.
• Revocable — disconnect a brokerage at any time from Settings, or revoke VibeTrader’s access from your broker.

Your money stays at your broker

• No custody — VibeTrader never holds your cash or securities. They stay in your own account at your own broker.
• No withdrawals — the product can place and cancel orders and read your positions. There is no code path anywhere in VibeTrader that moves money out of a brokerage account.
• Your broker is the regulated entity — for example Alpaca Securities LLC is SEC-registered, a FINRA member and SIPC-protected. VibeTrader is a technology platform, not a broker-dealer or an investment adviser.

Accounts and access

• Authentication — accounts are authenticated through Firebase Authentication, including Google, GitHub and Apple sign-in. Where an account has an email-and-password credential stored on our side, only a bcrypt hash is kept — passwords are never stored in readable form.
• Sessions — short-lived access tokens with refresh-token rotation, and detection of a reused refresh token.
• Database rules — Firestore access rules deny by default; every read and write is checked against the signed-in user.
• Rate limiting — API endpoints are rate-limited to blunt abuse and credential-stuffing.

How we work on security

• Internal reviews — we run internal security reviews of the codebase and act on what they find. The findings and the fixes are tracked in the repository.
• Error monitoring — Sentry, with sensitive fields scrubbed before they leave our servers.
• What we do not claim — VibeTrader has not had a third-party penetration test or security audit, and is not SOC 2 certified. The Google Cloud and Netlify platforms we build on hold their own certifications; ours are not implied by theirs.

Your controls

• Disconnect a brokerage at any time from Settings
• Pause or delete any bot, and choose what happens to its open positions
• Set position sizes, daily loss limits and other risk controls per bot
• Request deletion of your account and its data

Reporting a vulnerability

If you believe you have found a security issue, email security@vibetrader.markets with enough detail to reproduce it. We aim to acknowledge reports within three business days and will keep you updated while we investigate. Please give us a reasonable chance to fix an issue before disclosing it publicly, and do not access or modify other people’s data while testing. We do not currently run a paid bug-bounty programme.

If a security incident affects your data, we will contain it, notify affected users within 72 hours of confirming the impact, and tell you what to do next.