Show the evidence. Say what’s missing.

Reproduced Issues and source-established Issues need supporting evidence. Concerns require further investigation. Informational observations are not failures. Checks that did not run remain untested.

GitHub access is read-only by default. Write access for a supported blocker repair is separately approved and revocable. VibeCheck does not merge your changes or deploy your app.

The intended workflow runs application code and generated tests in disposable isolated environments, with tool permissions, network access, and budgets controlled outside the model.

Controlled fixture validation does not establish readiness for arbitrary customer applications.

Raw discovered secrets must not be retained in reports or logs, sent to the model, or tested against their provider. Evidence should be redacted while preserving enough context to understand the finding.

Completed checks describe their scope and results. They cannot establish that an app is secure, compliant, or production-ready. Legal compliance is outside the product’s scope.