Security

Last updated: July 26, 2026

Our security model

Webklip uses a link-as-secret model: knowing the URL is the primary access control for anonymous clips. For sensitive content, enable passphrase end-to-end encryption. Public Klipwall listings cannot use E2E or burn-after-read.

Transport security

Webklip is served over HTTPS. Secure cookies are used on encrypted connections. Always access the service over an encrypted connection.

Access controls

• Passphrase E2E — AES-256-GCM in the browser. A random content key is wrapped with a key derived from your passphrase (PBKDF2). The passphrase never leaves your browser; Webklip stores only ciphertext, salt, and the wrapped key.
• Short passphrases — allowed with an explicit warning. Stolen ciphertext plus a weak PIN can be cracked offline.
• Legacy PIN — older clips may still use a server-side bcrypt PIN gate (not encryption at rest).
• File uploads — disabled while a clip is E2E encrypted.

Data lifecycle

• Default TTL: 15 minutes, configurable per clip (up to 1 year)
• Burn-on-read: deletes on the first real web visit or API read; unread burn clips still expire after 7 days
• Background cleanup: expired clips, version history, and orphan files are permanently deleted
• View limits: optional cap on views (1, 3, 10, or unlimited)

Abuse prevention

• Per-IP rate limits on requests and clip creation
• File upload limits: 10 MB per file, 50 MB total, and 10 files per clip (configurable via MAX_FILE_SIZE_MB / MAX_TOTAL_FILES_MB)
• Text content limit: 1,000,000 characters per clip (includes multi-tab workspace JSON)
• URL validation on outbound callbacks to prevent server-side request forgery

HTTP security headers

We send Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy headers on all responses.

What we do not claim

• We do not encrypt data at rest in the database by default (use passphrase E2E for ciphertext-only storage)
• We cannot decrypt passphrase-protected clips — and we cannot recover a lost passphrase
• We do not guarantee protection against someone who already has your link and passphrase
• Short passphrases do not resist offline attacks if ciphertext is stolen

Responsible disclosure

If you discover a security vulnerability, please report it to contact@logimaxx.ro. We appreciate responsible disclosure and will work to address confirmed issues promptly.