Skip to main content
In short: to scan your repository, CybeDefend has to receive it. We clone it into an isolated container, run the security checks, then destroy the container together with its copy of the code. We do not keep your source code after the scan. What we keep is the result: findings, their location, and repository metadata.
Scanning platform and VibeDefend are two different things. The platform receives your repository when you ask it to scan. VibeDefend, the layer that plugs into your AI coding agent, runs on the developer’s machine: edits happen locally and only governance metadata comes back. This page describes the platform.

Temporary Container Approach

When you connect your repository to CybeDefend, we create a fresh container to clone and analyze your code. This container is isolated and used only for your specific scan. Once the scan is done:
  • The container is terminated.
  • Any temporary copies of your code are destroyed immediately.

The Process at a Glance

CybeDefend securely clones your repository into an isolated container, performs a vulnerability analysis, extracts only security findings, and completely wipes the container and code once the scan is complete.
Secure Container Scanning

What we keep, precisely

The business-logic knowledge graph

If you enable the AI features that learn your repository’s own conventions, we build and keep a knowledge graph of your codebase. This is what lets the agent apply your business rules the next time it writes code. The graph holds file paths and a short description of what each file does. It does not contain your source code.
  • You can delete it at any time from the project settings.
  • Disabling the AI features stops it being built in the first place, and no code is sent to the models.

Where the analysis runs

Everything above happens inside the region you selected at signup: Scaleway for the EU region, Google Cloud for the US region. AI inference runs on open-weight models we host ourselves, in that same region. No code and no prompt is sent to any third-party AI API, and nothing crosses the regional boundary. See LLM Usage & Privacy.