Security

Vibestreet is built security-first. Every skill runs in an isolated sandbox, every data access is declared upfront, and our compliance posture covers ISO, GDPR, EU AI Act, SOC 2, and PCI.

Compliance & Certifications

ISO 27001Information security management system

Active

ISO 27701Privacy information management extension

Active

ISO 42001AI management system standard

Active

GDPREU General Data Protection Regulation

Active

EU AI ActEuropean AI Act — High Risk classification

Active

SOC 2 (Type I planned)Service organization controls audit — Type I preparation in progress

Active

PCI SAQ-APayment Card Industry — SAQ-A merchant level

Active

Responsible Disclosure

Report a Vulnerability

Email: security@vibestreet.dev

Initial response within 24 hours
CVE triage completed within 72 hours
Critical patches deployed within 7 days
Public disclosure after patch — coordinated with reporter

Skill Vetting Pipeline

Every skill published to Vibestreet goes through a four-stage vetting pipeline before reaching general availability.

Scan

Automated static analysis — secrets, CVEs, OWASP Top 10, capability declaration audit.

Canary

Deployed to 0.1% of users. Telemetry monitored for anomalous capability usage.

Early

Deployed to 5% of users. Human review of AI-generated vetting summary (EU AI Act Art. 50 disclosure generated here).

GA

Full release. Ongoing runtime monitoring and quarterly re-vetting.

Kill Switch

If a skill is found to be malicious, compromised, or in breach of policy, Vibestreet can remotely disable it across all installations within minutes.

Detection → Kill switch activation< 5 minutes

Propagation to all active clients< 15 minutes

Affected user notification< 1 hour

Kill Switch Behavior

When triggered, the skill is immediately prevented from executing new requests. In-flight requests are terminated gracefully. The skill remains visible in the marketplace with a security notice until the issue is resolved or the skill is permanently removed.

EU AI Act Art. 50 Disclosure

All skills reviewed via AI-assisted vetting are labeled with an AI-vetted badge on their marketplace listing. This is a mandatory transparency disclosure under EU AI Act Article 50.

For penetration testing, security partnerships, or compliance inquiries: security@vibestreet.dev

SDK Guide

Compliance & Certifications

ISO 27001Information security management system

Active

ISO 27701Privacy information management extension

Active

ISO 42001AI management system standard

Active

GDPREU General Data Protection Regulation

Active

EU AI ActEuropean AI Act — High Risk classification

Active

SOC 2 (Type I planned)Service organization controls audit — Type I preparation in progress

Active

PCI SAQ-APayment Card Industry — SAQ-A merchant level

Active

Skill Vetting Pipeline

Every skill published to Vibestreet goes through a four-stage vetting pipeline before reaching general availability.

Scan

Automated static analysis — secrets, CVEs, OWASP Top 10, capability declaration audit.

Canary

Deployed to 0.1% of users. Telemetry monitored for anomalous capability usage.

Early

Deployed to 5% of users. Human review of AI-generated vetting summary (EU AI Act Art. 50 disclosure generated here).

GA

Full release. Ongoing runtime monitoring and quarterly re-vetting.

Kill Switch

If a skill is found to be malicious, compromised, or in breach of policy, Vibestreet can remotely disable it across all installations within minutes.

Detection → Kill switch activation< 5 minutes

Propagation to all active clients< 15 minutes

Affected user notification< 1 hour

Kill Switch Behavior

EU AI Act Art. 50 Disclosure

All skills reviewed via AI-assisted vetting are labeled with an AI-vetted badge on their marketplace listing. This is a mandatory transparency disclosure under EU AI Act Article 50.

For penetration testing, security partnerships, or compliance inquiries: security@vibestreet.dev