Security

Current controls

• HTTPS transport through Cloudflare for public web and MCP endpoints.
• Passwords derived with scrypt using a fresh random salt. Plain-text passwords are not stored.
• Secure session cookies in production and short-lived access tokens.
• OAuth authorisation code flow with PKCE for MCP clients, scoped read, write, and delete permissions, and revocable refresh tokens.
• Per-user authorisation checks on list, search, retrieve, update, and delete operations.
• Database-backed rate limits for authentication and mutation limits for archive operations.
• Managed edge infrastructure from Cloudflare and managed PostgreSQL infrastructure from Neon.

Your role

Use a unique password, review OAuth permissions, revoke clients you no longer use, and protect devices where your agents run. Do not store passwords, private keys, payment card data, or specially regulated health data in Clipboard.

Responsible disclosure

If you believe you found a security vulnerability, email security@clipboard.work. Include a clear description, reproduction steps, affected endpoint, and potential impact. Do not access other users' data, disrupt the service, or publicly disclose an unresolved issue.

We will acknowledge a valid report, investigate it, and work toward a proportionate fix. We do not currently operate a paid bug bounty.

Incidents

We investigate suspected security incidents and will notify affected users and authorities when required by applicable law.

No certification claim

Clipboard does not currently claim SOC 2, ISO 27001, or another independent security certification. This page describes controls we actually operate today.