Security and privacy
Protect provider identity, account ownership, credentials and metered usage.
Authentication and authorization
- Validate account credentials server-side; do not trust browser state alone.
- Keep authorization data out of user-editable metadata.
- Bind provider OAuth state to the current user and purpose in a signed, expiring intent.
- Match Pages with provider-issued immutable IDs.
- Enforce ownership for every private read and account change.
Secrets
- Provider, inVerus and Stripe secrets remain server-only.
- Access Keys are hashed and shown once.
- Provider access tokens never enter public Page data or client responses.
- Logs redact secrets and limit provider error bodies.
Billing
Plan and credit fulfillment requires a confirmed Stripe event or Checkout verification. A browser return URL alone never grants capacity.
Privacy
Document what public provider facts appear on Pages, why they are processed and how users control editable presentation and notifications. Verification facts and public-source evidence remain distinct from private provider tokens.
Authorization boundaries
Private connections, Access Keys, billing state and ownership controls are available only to the signed-in owner. Public Pages expose canonical identity, verification and score evidence without exposing provider tokens, billing records or private account data.
User-editable profile fields never establish ownership. Provider authorization and immutable provider IDs remain the authority for canonical Page matching.
OAuth and connection security
- Bind state to provider, purpose, original user, return path and expiry.
- Store PKCE verifier, nonce and temporary provider credentials in HttpOnly/server storage.
- Read immutable provider IDs after server-side token exchange.
- Stop before all writes when an identity belongs to another user.
- Keep connection/add-page callbacks separate from primary sign-in behavior.
Billing security
The Console cannot grant credits or set a plan by itself. Clawdbase verifies the billing account and confirmed Stripe state before changing entitlements.
Logging and retention
Redact Authorization headers, cookies, OAuth codes, provider tokens, secrets and private evidence. Log safe IDs, route, status and timestamps for correlation. Define retention independently for public Page evidence, private connection data, billing records and operational logs.
Report a concern
If an ownership, credential or billing action appears on the wrong account, stop the action and contact support with the safe Page URL, ledger ID or connection label. Never include an Access Key, OAuth code, provider token, cookie or complete payment detail.