Runs in your environment
The console deploys into your VPC, Kubernetes cluster, cloud account or air-gapped datacenter. Chunks, embeddings, findings and evidence stay in infrastructure you control.
Security
Security model and responsible disclosure
VecShield runs in your environment, calls no VecShield service and sends no telemetry, so we never hold your chunks, embeddings or findings.
Responsible disclosure
Found a vulnerability in VecShield or this website? Report it privately to contact@vecshield.org. We acknowledge reports and coordinate disclosure with reporters. Do not open public issues for unpatched vulnerabilities.
Architecture
No telemetry
The console sends nothing to VecShield. Its outside calls are vulnerability lookups: dependency CVEs against OSV.dev, and public advisory feeds if an admin turns on updates. Both can be switched off for air-gapped installs.
Masked by default
Findings store a masked preview, not the text. Chunk text is fetched from the store only when a reviewer asks. Raw values need the compliance role and a reason, and each reveal is logged.
Safe mode
Safe mode is on by default and blocks every write to your stores. With it off, each change still needs approval from a second person and is read back after it runs.