Security
A security tool should be secure by design
Here's exactly what VIfix does with your code, keys and data.
Your code stays on your machine
- Scanning runs inside the desktop app. Source code is never uploaded to VIfix's servers.
- Private GitHub repos are downloaded with your own token to a temporary folder, scanned, and deleted.
- Our servers only store your account, subscription and usage counts.
Secrets are never exposed
- Detected credentials are masked everywhere they're displayed, including diffs.
- When you request an AI fix, only the affected file is sent to the provider you chose, with every detected secret replaced by a placeholder.
- Patches that would write a secret back into code are rejected.
Credentials are encrypted
- GitHub tokens, AI keys and your session are encrypted with your operating system's keychain.
- Desktop sessions use opaque tokens, stored hashed on our side and revocable at any time by signing out.
- Sign-in uses PKCE; the app ignores login links it didn't start.
Fixes are reviewed, never forced
- Every patch is re-scanned and syntax-checked before you see it.
- Patches can't touch CI workflows, env files, lockfiles or anything outside your project.
- Pull requests are opened on a new branch; VIfix never pushes to your base branch and refuses if the file changed upstream.
Hardened app and infrastructure
- Signed and notarized installers with Electron security fuses and ASAR integrity checks.
- Sandboxed renderer with a strict content security policy; all network access goes through the main process.
- Database tables use Row Level Security; payments are handled entirely by Stripe.
Found a vulnerability? Email hello@getvifix.com. We appreciate responsible disclosure.