Security & API Key Protection — Vibe-Coding Workflow

Your API keys and project data are protected through a zero-server-trust architecture. All sensitive data stays in your browser — never transmitted to or stored on Vibe-Coding Workflow servers.

How We Protect Your API Keys

  • Browser-only storage: API keys are stored exclusively in your browser's localStorage. They are never sent to our servers.
  • Direct API calls: All AI requests go directly from your browser to the AI provider (Gemini, OpenAI, Anthropic, OpenRouter). We have no server-side proxy that touches your keys.
  • No authentication required: The tool works without creating an account. There's no server-side session that could be compromised.
  • Open source verification: You can inspect every line of code on GitHub to verify our security claims.

Security Best Practices

We recommend using API keys with appropriate spending limits and permissions. For Gemini, use a project-scoped key. For OpenAI, set a monthly spending limit. For Anthropic, use workspace keys with usage limits. Never share your browser session with untrusted parties while your API keys are stored.

Reporting Security Issues

If you discover a security vulnerability, please report it through our contact form or open a security advisory on our GitHub repository. We take all security reports seriously and aim to respond within 48 hours.

Privacy Policy | Terms of Service