Security and trust
Know exactly what Vybentis can prove.
Vybentis reports bounded, evidence based checks. It does not claim absolute security, replace a penetration test or turn unknown scope into a pass.
Four trust boundaries
Every evidence source stays inside its permitted scope.
Public surface
Passive checks read what is already publicly reachable.
Repository snapshot
Only an authorized, resolved commit is analyzed statically.
Control plane
Scanner workers cannot access the product control database directly.
AI explanation
Mistral receives only bounded, redacted and structured inputs.
Can prove
Observed evidence in the documented scope.
- Record observed HTTP headers
- Report deterministic rule violations
- Bind the exact repository commit
- Verify the same rule again
Cannot prove
What remains invisible outside the scan.
- Guarantee absolute security
- Judge unobserved backend policies
- Prove historical secret absence from a URL
- Certify legal compliance
Data minimization
From hostile input to a safe finding.
Raw inputs are bounded, normalized and redacted before they reach a report or the AI layer.
Security invariants
Controls that are not optional.
Credentials are redacted before persistence, logs, reports and AI processing.
Scanners are disposable, quota bound and have no direct control database access.
SSRF controls block private targets, redirects and resolved internal addresses.
Tenant identity is enforced in database policies and object paths.
Customer code is never installed, built or executed in the control plane.
Time, pages, bytes, files, requests and cost have hard limits.
Common questions
The important boundary, answered directly.
No. Passive public checks and authorized repository analysis are bounded automated checks.
Next step
Route a security question directly.
Choose Security in the contact form and do not include secrets, payloads or customer data in the first message.