Security
Security you can verify
We'd rather show you the controls than just claim them. Here's what's protecting your account today, and what we're still building.
Email-verified sign-in
No bot can be created or run until you've verified your email — enforced both in the app and at the database layer.
Per-user database rules
Every bot record is scoped to its owner. Database rules block reading, editing, or running anyone else's bot.
Code safety gate
Before a bot runs, its code is parsed and checked for filesystem access, shell commands, dynamic imports, and sandbox escapes. Dangerous code is blocked.
Hardened HTTP headers
A strict Content-Security-Policy, HSTS (HTTPS-only), clickjacking protection, and MIME-sniffing protection ship on every response.
Re-authentication for sensitive actions
Changing your password or deleting your account requires re-entering your credentials, so a walked-away session can't do damage.
Encrypted in transit
All traffic to and from Clockwise is served over HTTPS with automatic certificate management.
What we're still building (and won't pretend otherwise)
Found a vulnerability? Please report it privately to support@clockwise.cv — we appreciate responsible disclosure.