Vibe-Check: Service Terms

Version VC-1.0, effective October 30, 2026. A supplement to our Launch Security Review Terms of Service, v3.2.

V1. How these terms work. The Vibe-Check is sold by Ada Gen Intel LLC, a Minnesota limited liability company. Our Launch Security Review Terms of Service, version v3.2 of October 30, 2026, at https://adagi.blog/review-terms/ (the “review terms”) apply to every Vibe-Check, as changed by this page. If this page and the review terms conflict, this page controls for the Vibe-Check. In the review terms, as applied to the Vibe-Check: “smart contracts” and “contracts” mean your app’s source code and configuration; “commit” means the version we confirm in writing (a repository commit, or the files as received on a stated date); “SLOC” means lines of source; and the “order” is the authorization form you sign together with the payment link we send you.

V2. Who can buy (adds to clauses 0 and 16). For now the Vibe-Check is offered only to buyers in the United States who are at least 18 and who buy for a business or commercial project, including as a sole proprietor or independent maker. It is not offered for personal, family or household use, or to buyers in the European Union, the European Economic Area, the United Kingdom or Switzerland. You accept these terms and the review terms by replying to our authorization form with your typed name and “I agree”, and you confirm that acceptance by paying. Clause 16 (sanctions) applies; we screen your name and country before we send the payment link.

V3. Service and scope (replaces clauses 1 and 2). We perform an offline, AI-assisted, best-effort review of the source code and configuration of one small web app that you send us or share with us read-only, up to about 15,000 lines of source. We review only the files and version we confirm in writing. Everything else is out of scope, including your running app, your hosting, the third-party services you use and later changes. If the files turn out larger or more complex than we confirmed, we tell you before work starts; you may then cancel for a full refund, or we may agree a different service in writing.

V4. Method: code and settings only (replaces clause 3). We read only the files you send or share. We will not, even if you ask later: send any request to your running app, your Supabase or Firebase project, your hosting or any other URL; log in to anything; use any key, token or password found in the files; guess passwords or keys; change or delete any data; run exploits or load tests; or test any third party.

V5. Ownership and authority (adds to clause 18). You must own or control the app and the accounts behind it, or have the owner’s written permission. We may ask for proof, for example a repository invite from the owning account or the owner’s written permission, and we may decline the order, with a full refund, if we are not satisfied. The statements you make in the authorization form are representations under clause 18, and your indemnity in clause 18(a) also covers third-party claims arising from a false statement in that form about ownership, permission or your right to share the files. You may withdraw your authorization at any time by email; we then stop work, and clause 12 applies to refunds.

V6. Payment and timeline (changes clauses 4 and 5). The price is $100 (USD), paid upfront by the payment link we email you after you sign the form. Our target is to deliver the report within 3 business days after we have both your payment and the agreed files. Clause 5 applies: this is a target, not a guarantee.

V7. What you get (replaces clause 6 and clause 9(b)). A written report (PDF by email) with a short summary, findings ranked by severity, a plain-language explanation of each, a suggested fix, and where practical a check you can run yourself on your own project. Findings come from reading the code and settings. We do not run them against your app, and we do not provide proof-of-concept tests that we have run. Severity ratings and suggested fixes are our best judgement and may be wrong; test every fix before you rely on it. You get one round of questions by email within 14 days after delivery. Fix review and re-checks are not included unless we agree them in writing and you pay for them first.

V8. Deliverable check (changes clause 6A). Clause 6A applies, but the only ground is that the report does not cover the files and version we confirmed. References in clause 6A to a proof of concept do not apply.

V9. Personal data and retention (changes clauses 7 and 21). Do not send real users’ personal data, passwords, service-role keys, private API keys or database connection strings. Send schema-only database exports, not data. The Vibe-Check is not for apps that hold health records, payment card numbers or children’s data, unless we agree otherwise in writing before you pay. If personal data of real users turns up in the files, we do not use it for anything else, we delete it and we tell you. If a secret turns up, we tell you and you must rotate it; we never use it. We delete your files and working copies within 14 days after delivery, or sooner if you ask. We keep the report, the signed form and our emails as business records, as described in our privacy notice.

V10. What stays the same. All other review terms apply unchanged, including AI assistance and providers (clause 9, except 9(b)), no guarantee (clause 10), the limit of our liability to the fees you paid (clause 11), refunds (clause 12), report licence and publication (clause 14, where “at the stated commit” means “at the version reviewed”), sanctions (clause 16), Minnesota law and arbitration, with the small claims option (clause 17), and taxes (clause 28).

Questions: ada.genintel@gmail.com