Legal

Terms of Service

Last updated: October 18, 2026

1. About these terms

These terms are an agreement between you and Vibe Pit Crew, a business based in Ontario, Canada ("we", "us"). They apply when you request a free check, buy a Lockdown Fix, subscribe to re-scans, or otherwise use vibepitcrew.com or our GitHub App. If you use the services for a company, you confirm you're allowed to accept these terms for it, and "you" means that company.

Our Refund Policy and Privacy Policy are part of these terms. By submitting the free-check form, checking out, or installing our GitHub App, you agree to them.

2. What we provide (scope)

We work on web apps built with Lovable that use Supabase, either your own Supabase project or Lovable Cloud, with code in a GitHub repository.

Free Check ($0)

• Passive check: we load only what any browser would load from your app's public address (HTML, JavaScript files and response headers). We look for exposed secret keys, whether Supabase is in use, and missing security headers. We don't send anything to your database.
• Verified check (optional): after you prove ownership (section 4), we make read-only requests to your app's database API, using only the public key your app already ships, to see which tables and storage buckets are open. We report table names, yes/no per operation and row counts. We never read or keep the contents of rows.

Lockdown Fix ($79, one-time)

• We copy your repo's database structure into a private, local test database. We never connect to or write to your production database.
• We write and test a fix: row level security (RLS) policies on exposed tables, tighter database permissions, private storage buckets where needed, and moving up to 3 client-side secret keys into server-side functions.
• You get one pull request on a separate branch (vibepitcrew/lockdown), a test file that shows what changed, a plain-English report, a key-rotation checklist, a list of secrets found in your git history, and instructions for applying the database change.
• After you tell us you've applied it, we run one read-only re-check of your live app. If our change broke something, we fix it once at no charge if you tell us within 14 days.
• Limits: up to 25 tables and 5 storage buckets, with standard ownership patterns (per-user data, profiles, public content, and teams with owner/admin/member roles).
• Not included: penetration testing, audits, certifications or compliance work (for example SOC 2, HIPAA or PCI); custom authentication; Firebase; GitLab or Bitbucket; payment or webhook logic; complex sharing or role systems; moving or backfilling your data; new features; and rotating your keys or applying changes to production for you. We point out issues we notice outside the scope, but we don't fix them.

Re-scan ($19 per month)

• We re-scan your repo when you push to it and check your live app weekly, then email you if a new table ships without protection or a new secret key appears.
• Re-scans report problems. They don't include new fixes. While you subscribe, our GitHub App stays installed on the one repo you chose.

How the work is done

Vibe Pit Crew is run by automated AI agents. They scan, write the fix and test it. Before delivery, every pull request must pass a strict review by our AI review agent against a fixed checklist. No human reviews the code unless we tell you so. The business owner handles refund disputes and legal matters.

If we find before delivery that your app is outside this scope, we'll tell you why and refund you in full.

3. Your promise: you own the app or are authorized

Testing someone else's app without permission can be illegal. So when you request a check, check out or install our GitHub App, you promise that:

• you own the app, its domain, its repo and its Supabase project, or you have the owner's written permission to have them tested and changed;
• the information you give us is accurate, including which repo builds the app; and
• letting us run the checks described here doesn't break any agreement you're bound by, such as a hosting provider's or employer's rules.

If your authority changes or ends, tell us right away and we'll stop work.

4. Ownership verification

We only look beyond what any visitor can see after you prove you control the app. We give you a one-time token, and you publish it in one of these ways:

• a meta tag vibepitcrew-verification on your app's home page;
• a file at /.well-known/vibepitcrew.txt on your app's domain; or
• a DNS TXT record at _vibepitcrew. followed by your domain.

For a Lockdown Fix, we also check that the repo you connect builds the app you verified, by matching its Supabase project reference with the live app. If anything doesn't match, or we have any reason to think you aren't authorized, we stop, remove our access and refund you. You can remove the token once the job is done. For re-scans, keep it in place.

5. Access to your repo and data

• GitHub App (recommended): you install it on one repo you choose. It asks only for permission to read and write code and pull requests and to read basic repo details. It doesn't ask for administration, workflows or secrets.
• Alternatives: if our app isn't available, we may ask you to invite a Vibe Pit Crew machine account as a collaborator, which GitHub only offers with write access. Or you can apply a patch file yourself and give us no access at all.
• Our rules: we only push to our own branch. We never merge, never push to your default branch, never force-push and never rewrite your history.
• Secrets: never send us secret keys or passwords for real accounts. If you do, we'll delete them and ask you to rotate them.
• Test accounts: for the re-check, you may give us logins for two throwaway test accounts in your app. We use them only for read-only checks and delete them when the job closes. Please delete those accounts afterwards.
• We remove our access and delete our copy of your code when the job closes, unless you keep a re-scan subscription. See the Privacy Policy.

6. No guarantee of total security

No check or fix can make an app completely secure. Ours focus on a specific set of common problems in Lovable and Supabase apps, and our report lists what we checked and what we didn't. In particular:

• a clean result means we didn't find those problems. It doesn't mean your app has no vulnerabilities;
• our work is automated and AI-reviewed, and it can contain mistakes. That's why everything arrives as a pull request with tests for you to review first;
• your app keeps changing. New prompts in your AI builder, new code or new settings can undo a fix or add new problems; and
• our services aren't a penetration test, a security audit or a certification, and you shouldn't describe them that way to others.

Except for the promises we make in these terms, and to the extent the law allows, the services are provided "as is", without other warranties or conditions, including fitness for a particular purpose.

7. Your responsibilities

You stay in control of your app, and these steps are yours:

• Review and merging: read the pull request and decide whether to merge it. Nothing changes in your app until you do.
• Applying and deploying: apply the database change (for Lovable Cloud, through Lovable's chat or SQL editor, using the instructions we give you), then re-publish your app. Merging alone doesn't publish in Lovable.
• Key rotation: if we report an exposed key, create a new key, put it in your server-side secrets, then revoke the old one at the provider. Removing a key from your code doesn't make a copied key stop working, so rotation is the real fix. We never handle your keys.
• Backups and testing: keep backups of your code and data, and check your app after you apply the change.
• Telling us: reply "applied" when you're done so we can re-check, and tell us within 14 days if something broke.

We aren't responsible for problems caused by changes that weren't applied, were applied differently from our instructions, or were later undone, or for keys that weren't rotated.

8. Service levels

Times are in business days: Monday to Friday, 9:00 am to 5:00 pm Eastern Time (Toronto), excluding Ontario statutory holidays.

We work hard to meet these times. If we miss one, your remedy is the refund described in the Refund Policy, or other remedies the law gives you.

9. Prices and payment

• Prices are in US dollars and are shown before any sales tax. Tax is added at checkout where it applies.
• The Lockdown Fix is paid in full at checkout. Re-scans are billed monthly in advance and renew automatically until you cancel.
• Payments are processed by our payment provider. If your checkout is run by Paddle, Paddle is the seller of record (the reseller) for your order. Paddle's Buyer Terms and Refund Policy then also apply to the payment, billing, tax and refund side of your purchase, and your receipt comes from Paddle. These terms still govern the service we provide. If your checkout is run by Stripe, you buy directly from us, and Stripe processes the card payment for us.
• We'll give you at least 30 days' email notice before a re-scan price increase. You can cancel before it takes effect.

10. Refunds and cancellation

Our Refund Policy explains when you get your money back, including automatic full refunds when we find no critical or high-severity problem, or when we don't deliver within 5 business days. You can cancel re-scans at any time.

11. Acceptable use

You agree not to:

• ask us to check, or try to verify, an app, domain or repo you don't own or aren't authorized to test;
• use our reports, findings or the verified check to attack, access or take data from any system;
• flood the free-check form, automate requests, get around our rate limits, or try to break, overload or reverse-engineer our services;
• send us malware, other people's personal information, or anyone's live secret keys or passwords;
• use the services for an app that is illegal, or that harms or defrauds people; or
• say a Vibe Pit Crew check is an audit, certification or endorsement, or use our name to suggest we vouch for your app's security.

We may refuse or stop work, and report abuse to the right authorities or platforms, if we reasonably believe these rules are being broken.

12. Who owns what

• Your app, code and data stay yours.
• Once you've paid, the changes in your pull request and your report are yours to use, change and keep, for your app. Some parts are based on our general templates (for example standard policy patterns and test scaffolding). We keep the right to reuse those templates, but never your code or details about your app.
• Our scanner, website, GitHub App, templates and brand stay ours.
• If you send us feedback, we may use it to improve the services without owing you anything.

13. Limitation of liability

To the fullest extent the law allows:

• Our total liability for all claims about the services is limited to the fees you paid us for the service the claim relates to in the 12 months before the event that caused the claim. For the free check, which costs nothing, that amount is zero.
• We aren't liable for indirect or consequential losses, such as lost profits, revenue, data, goodwill or business opportunities, or for the costs of a security incident, even if we were told they were possible.
• We aren't liable for losses caused by things outside our control, by third-party services (such as Lovable, Supabase, GitHub or your hosting), by your own changes, or by steps in section 7 that weren't taken.

Nothing in these terms limits liability that can't be limited by law, such as liability for fraud or for intentional wrongdoing, or any rights you have as a consumer that can't be waived under the laws that apply to you.

14. If your promise was untrue

If you ask us to check or change an app you weren't authorized to have tested, or you break section 11, you agree to cover our reasonable costs and losses from claims by others that result, including reasonable legal fees. This doesn't apply to the extent the claim was caused by our own breach of these terms.

15. Suspension and ending

• You can cancel re-scans at any time (see the Refund Policy), and you can uninstall our GitHub App at any time. Uninstalling during a Lockdown Fix stops the work.
• We may suspend or stop a service, and remove our access, if you break these terms, if we can't confirm ownership, or if continuing would be unlawful or unsafe. If we stop a paid service for a reason that isn't your fault, we refund what you paid for the part we didn't deliver.
• Sections 3, 6, 12, 13, 14 and 17 still apply after the services end.

16. Changes to these terms

We may update these terms, and we'll change the "Last updated" date when we do. A one-time purchase is governed by the terms in place when you bought it. For re-scan subscriptions, we'll email you at least 30 days before a significant change takes effect. If you don't agree, you can cancel before then.

17. Governing law

These terms are governed by the laws of the Province of Ontario and the federal laws of Canada that apply there. Courts in Ontario have jurisdiction over any dispute, except that if you're a consumer, you keep any right you have to bring a claim in the courts where you live and to rely on the mandatory consumer protection laws there. Before going to court, please email us. Most problems can be fixed quickly.

If any part of these terms can't be enforced, the rest still applies. If we don't enforce a term right away, we can still enforce it later. You may not transfer these terms without our consent. We may transfer them to a company that takes over Vibe Pit Crew, and we'll tell you if we do.

18. Contact

Vibe Pit Crew
Email: hello@vibepitcrew.com