This might seem like an aggressive question. But it's one to be asked of products dealing with auth.

For a security-centric product, how would I trust your fully vibe-coded product if I can't see the source code?

Hey! Fair question.

We are currently in the process being fully SOC2 compliant and have gotten pen tested twice from two different companies and have found no issues. You can explore the full extent of our security process and pen test results here : trust.alterauth.com

Separately would say it is a bad assumption to make that a product is vibe coded without trying it out. As mentioned in the post we adopted a lot of security processes as a part of our SDLC including consistent scans for supply chain attacks, and static code scanners (SAST).

We also do a pen test at a yearly cadence