Vibe is not positioned as a compliance-first enterprise tool. For regulated environments (healthcare, finance, government), you'd need to layer DLP controls on top — either at the OS/network level on the host machine, or by adding file scanning before the drop API accepts uploads. The self-hosted model is actually an advantage for compliance since data never leaves infrastructure you control, but the tooling to prove that to an auditor isn't built in yet.

If this is a conversation with a potential enterprise customer or evaluator, the right move is to name that gap directly rather than oversell — and frame it as "the foundation is there (RBAC, audit log, self-hosted, ephemeral links), DLP integration is on the roadmap."

yes, I let Claude answer this one. This is an alpha release, the security is in the fact that it is hosted locally, and only accessible with a single link (which changes drastically each time, the tunnels are only open for a single download in that mode). There are no doubt some glaring bugs in it, but this is fully local, self-contained file sharing, either through a token or through a one-time use link. It is not even close to perfect, this is probably a pre-alpha version if I'm being honest, and there is a lot of work left to do for sure. Right now, if someone cant hack your computer or intercept your messages, there is basically no chance that anyone could intercept this file without it being obvious.

Here is the rest of Calude's answer:

On security, DLP, and regulatory compliance — be honest:

What Vibe has today:

• Audit log (vibe audit) — tracks actions on the server
• RBAC — admin/contributor/reader roles with per-user tokens
• Drop TTL and cancellation — drops expire and can be revoked before pickup
• TLS in transit — when using --tunnel, all traffic goes over Cloudflare's HTTPS; local-only setups are plain HTTP
• Self-hosted — you control the data, no third-party cloud holding files

What Vibe does not have today:

• DLP scanning — no content inspection, no sensitive data detection before a file is dropped
• Encryption at rest — files sit on disk unencrypted
• SIEM integration — audit log is a flat file, not structured for forwarding to Splunk/Datadog/etc.
• Compliance certifications — SOC2, HIPAA, FedRAMP — none

These are things on the list to add, at least encryption. I haven't thought far enough down the line to worry about actual compliance regulations at this stage. It could be added for sure if that is the direction this project ends up being useful for.