Trust & method

Built to be trusted with your attack surface

A security tool has to hold itself to a higher bar. Here is exactly how VICE separates public scans, verified audits and remediation, and what it will never do.

Ownership before intrusive checks

Anonymous visitors only ever get passive, public checks. The deeper audit unlocks after a DNS TXT record proves the domain is yours.

Evidence stays attached

Findings keep their raw evidence next to the remediation context, so you can verify every claim a report makes.

Scoped by design

Webba ID handles identity, and row level security scopes every workspace to its owner. We audit RLS for a living: ours has to be exemplary.

Explicit remediation flow

AI Fix prompts, solved states and history resets are deliberate actions you trigger, never something that mutates your data silently.

-- ai fix · missing-rls-policy
- grant select on public.users to anon;
+ alter table public.users
+   enable row level security;
+ create policy "own rows" on public.users
+   for select using (auth.uid() = id);

What a full audit covers

Black-box checks from the outside, white-box checks from your repo. Both feed one score.

security headersTLS and HSTScookie flagsCORS policyCSP analysisexposed .env and configsleaked secrets in JSopen directory listingsrobots and security.txtSupabase RLS policiesstorage bucket exposureauth flow weaknessesvulnerable dependenciesCI workflow securitygit history leaks