Security at Clawifi.

Controls in place

• Encryption in transit and at rest: the site and the API are served over HTTPS only, and stored data and backups are encrypted.
• Hashed credentials: passwords are stored as salted, slow hashes; API keys, session tokens, invitation links and email links are stored only as hashes, so a copy of the database does not reveal them. A key is shown once, when it is made.
• Sessions: the console keeps its session in an HttpOnly, Secure cookie that page scripts cannot read. Sessions end after 30 days, at sign-out, or everywhere at once from the console.
• Cross-site requests: a request that changes anything with the session cookie must come from the Clawifi site itself; requests from any other origin are refused.
• Rate limits: sign-in, sign-up, password reset, the playground and keyless calls are limited per address, invitations per account, and calls by plan.
• Egress firewall for fetched targets: before Clawifi fetches a URL for you, the address is resolved and checked; private, loopback, link-local and cloud metadata addresses are refused, and redirects are checked the same way.
• Least privilege at runtime: the service runs as a non-root user, and each account only reads its own history, files, monitors and keys, or its organization's.
• Dependency audit in the build: every release installs pinned, hash-checked dependencies and is audited for known vulnerabilities before it ships.
• Organizations: owners and admins manage members; removing someone revokes the API keys they created in that organization at once.

Report a vulnerability

Email clawifisupport@rearclabs.com with the subject "Security". Tell us what you found, where, the steps to reproduce it and what an attacker could do with it. Do not include real passwords, API keys or other people's data; describe them instead. A person reads every report; we confirm we have it, keep you updated while we fix it, and tell you when it is resolved. We do not run a paid bounty programme today; with your permission we are glad to credit you.

Safe harbour

We will not pursue or support legal action against you for security research that is done in good faith and follows this page: you test only against your own account and data, you stop and tell us as soon as you reach anyone else's data, you do not degrade the service for others, you give us reasonable time to fix the issue before you share it, and you do not ask for payment in exchange for not disclosing it. If a third party brings a claim about research that followed these rules, we will make it known that your work was authorized. If you are unsure whether something is in bounds, ask first at clawifisupport@rearclabs.com.

Out of scope

• Denial of service, load or stress testing, and volumetric attacks.
• Social engineering of our team or users, and physical attacks.
• Spam or brute force against sign-in, sign-up or the playground (these are rate limited).
• Reports from automated scanners without a demonstrated impact, missing best-practice headers with no exploit, and clickjacking on pages without actions.
• Third-party websites that Clawifi fetches for you, and the services of our providers; report those to their owners.
• Using Clawifi against sites you do not own or are not authorized to test; that is covered by the acceptable use rules, not by this page.

Incidents

If a breach affects your personal data, we notify the relevant authority and the affected customers without undue delay, as the law requires; the Privacy Notice describes how. To report a suspected incident or abuse of Clawifi against your site, write to clawifisupport@rearclabs.com or see Report abuse.