Security

Last updated August 28, 2026.

This page describes the controls Clarity has in place to protect your account, your data, and the service itself. It's a companion to our Privacy Policy.

Infrastructure & DDoS protection

Clarity is hosted on Vercel, which sits behind network-level DDoS mitigation and a Web Application Firewall in front of every request, automatically, before traffic reaches our application code. On top of that platform layer, sensitive application routes — login, signup, checkout, and admin publish endpoints — enforce their own per-IP rate limits, so a single client can't hammer those specific actions even within otherwise-allowed traffic.

Transport & browser security

• All traffic is served over HTTPS, with HSTS enforced so browsers never fall back to plain HTTP.
• A Content-Security-Policy restricts which origins scripts, styles, and connections can load from.
• Clickjacking is blocked via frame-ancestors 'none' and X-Frame-Options: DENY.
• MIME-sniffing is disabled (X-Content-Type-Options: nosniff), and unused browser features (camera, microphone, geolocation, USB, payment) are denied by default via Permissions-Policy.

Accounts & access control

• Authentication is handled by Supabase Auth; we never see or store your raw password.
• Login and signup are rate-limited per IP to blunt credential-stuffing and scripted account creation.
• Access to paid content is enforced server-side against your entitlements — never a client-supplied flag — and backed by Postgres Row-Level Security policies, not application logic alone.
• The admin dashboard is gated behind an authenticated admin role, separate from regular accounts.

Payments

All payments are processed by Stripe; Clarity never stores card numbers. Incoming webhook events from Stripe are cryptographically verified against our webhook signing secret before we act on them, and duplicate delivery of the same event (Stripe retries at-least-once) is de-duplicated so you're never charged or credited twice.

Data protection

Data is stored with Supabase (Postgres) and protected by Row-Level Security policies at the database layer, so access is enforced even if an application bug were to skip a check. See our Privacy Policy for what we collect and how long we keep it.

Reporting a vulnerability

If you believe you've found a security issue, please report it to us privately before any public disclosure. Include enough detail to reproduce the issue (affected URL, steps, and impact) and, if possible, a way for us to reach you. We'll acknowledge reports and keep you updated as we investigate. Please avoid actions that could degrade the service for other users — no automated scanning at volume, no accessing data that isn't yours, and no denial-of-service testing against production.

Contact

Report a vulnerability or ask a security question at clarityskill.team@gmail.com.