Security, Privacy & Whitelist Guard

Modern developers work on sensitive internal tools, proprietary frontend designs, and pre-release products. Vibe Inspect is architected from day one with a Zero-Telemetry, 100% Local Execution philosophy.

Core Privacy Principles

1. Zero External Network Requests

Vibe Inspect makes zero outbound HTTP, WebSocket, or analytics requests.

• No tracking pixels
• No telemetry SDKs (no Google Analytics, Sentry, Mixpanel, etc.)
• No remote code injection

All box-model calculations, DOM scans, and prompt generations happen entirely inside your local browser tab runtime.

2. Default Local Isolation

Upon installation, Vibe Inspect is locked down to local development environments only:

• http://localhost:*
• http://127.0.0.1:*

Attempting to activate the picker on external domains (such as https://github.com or production websites) will be blocked, and a friendly toast will notify you that the domain is not authorized.

Custom Domain Whitelist Management

When working on custom staging servers, local test domains, or intranet staging environments, you can configure allowed domains via the popup:

1. Click the Vibe Inspect icon in your browser toolbar.
2. Under Custom Whitelist, enter your domain pattern:
   • Specific domain: app.mycompany.internal
   • Wildcard pattern: *.staging.dev or *.local
3. Click Add.

Global Mode (Optional)

The popup includes an “Allow on All Websites” switch. We recommend keeping this disabled unless you frequently audit public third-party design systems.

Open Source & Auditable

Vibe Inspect is licensed under the permissive MIT License. The entire codebase is open for public review and independent security auditing:

• Repository: github.com/Sacilave/vibe-inspect
• Security Policy: SECURITY.md