Secrets Security
Strict secure coding rules, zero-trust cloud storage models, and local secret shielding mechanisms.
Zero-Secret Policy
Security is a primary directive for VibeBasket. Sensitive keys such as OpenAI or GitHub API tokens used by installed MCP servers never transit to or get cached inside the bundle database.
Zero-Trust Cloud Policy
Bundle manifests never contain end-user runtime secrets. The hosted app stores selected catalog metadata and optional encrypted admin backup-storage credentials, but not the API keys that installed MCPs or agent tools use at runtime.
Instead, when applying a bundle locally, the CLI parses target credential keys and safely prompts the operator inside the local terminal to inject them securely. The hosted app never sees those runtime values.
Secret handling then depends on the target adapter. Most IDEs require inline MCP env or header values in local config files, so the CLI resolves those secrets on the operator's machine and writes them only into that machine's local IDE config. Codex is a partial exception for remote MCP auth headers: when its native config format supports an environment-key reference, VibeBasket prefers that reference instead of serializing the raw token into TOML.
Rate Limiting
All public API endpoints are protected by a sliding-window rate limiter with per-IP tracking and automatic garbage collection. Proxy-derived IP headers are only trusted when self-hosters explicitly enable proxy trust.
| Endpoint | Limit |
|---|---|
| /api/health | 120/min |
| /api/catalog | 120/min |
| /api/auth/* | 60/min |
| /api/bundle/[id] | 60/min |
| /api/stacks | 30/min |
| /api/admin/stats | 30/min |
| /api/catalog/status | 5/min |
| /api/bundle POST | 20/min |
Security Headers
All responses include hardened headers. In production, HTML routes receive a nonce-based Content-Security-Policy so Next.js can hydrate safely without opening the door to blanket inline-script execution, and HSTS is enforced across the deployment.
| Header | Value |
|---|---|
| X-Frame-Options | DENY |
| X-Content-Type-Options | nosniff |
| Referrer-Policy | strict-origin-when-cross-origin |
| X-Permitted-Cross-Domain-Policies | none |
| X-Download-Options | noopen |
| Permissions-Policy | camera=(), microphone=(), geolocation=() |
| Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
| Content-Security-Policy | default-src 'self'; script-src 'self' 'nonce-<request-nonce>' 'strict-dynamic' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; object-src 'none'; manifest-src 'self'; frame-ancestors 'none' |
Admin Panel Security
The admin dashboard at /admin is gated behind OAuth-authenticated sessions. Access is restricted to email addresses listed in the ADMIN_OAUTH_EMAILS environment variable, and only verified allowlisted emails are promoted to admin.
| Feature | Description |
|---|---|
| Catalog Sync | Manually trigger registry synchronization from upstream sources. |
| Backup Mgmt | Create, list, download, and restore database backups to any configured storage backend. |
| FTS5 Index Health | Verify the full-text search index row count against the catalog table for integrity. |
| DB Health Check | Run database integrity diagnostics and detect corruption early. |
| Force Cleanup | Purge expired bundles, stale sessions, verification tokens, and old sync records, then vacuum. |
| User Overview | Inspect registered user counts, saved stack telemetry, and popularity leaderboards. |
| Admin Emails | Configure the comma-separated admin email allowlist persisted as site config. |
All admin actions are server-side only and require a verified administrator session. Rate limiting on the /api/admin/stats endpoint is 30 requests per minute.