Security

Last updated: October 26, 2026

At Claper, security is a core priority. As an open-source platform, we believe transparency is the best foundation for trust.

Infrastructure Security

• EU hosting: All infrastructure is hosted on Hetzner Cloud within the European Union (Germany/Finland)
• Encryption in transit: All connections use TLS 1.2 or higher
• Encryption at rest: Data is encrypted at rest using industry-standard encryption
• Network isolation: Services are isolated using firewalls and private networks
• Regular backups: Encrypted backups are performed regularly and stored within the EU

Application Security

• Authentication: Passwords are hashed using strong, modern algorithms. Session tokens are securely generated and managed
• Input validation: All user input is validated and sanitized to prevent injection attacks (SQL injection, XSS, CSRF)
• Access controls: Role-based access ensures users can only access resources they are authorized to use
• Error monitoring: We use Sentry for real-time error detection, allowing us to quickly identify and resolve security-relevant issues
• Dependency management: Dependencies are regularly audited and updated to address known vulnerabilities

Data Protection

• Minimal data collection: We collect only the data necessary to provide the service
• No data selling: We never sell user data to third parties
• GDPR compliance: We comply with the General Data Protection Regulation
• Data residency: All primary data is stored and processed within the EU on Hetzner infrastructure
• Consent-based tracking: Marketing and optional analytics tools (Clarity, Facebook Pixel, Reddit Pixel) are only activated with explicit user consent

Open Source Advantage

Claper is 100% open source. Our entire codebase is available on GitHub for anyone to review, audit, and verify our security practices. This transparency means:

• Security researchers can review our code at any time
• Vulnerabilities can be identified and reported by the community
• Our security claims are verifiable, not just stated

Incident Response

In the event of a security incident, we follow a structured response process:

1. Identification and containment: Immediately isolate affected systems
2. Assessment: Determine the scope and impact of the incident
3. Notification: Notify affected users within 72 hours as required by GDPR
4. Remediation: Fix the vulnerability and restore normal operations
5. Post-mortem: Conduct a thorough review and implement preventive measures

How to Report

Send an email to alex@claper.co containing:

• The affected component, version, or commit.
• Clear and reproducible steps demonstrating the vulnerability.
• Evidence of concrete security impact.
• Confirmation that the issue affects the latest release or current development branch.

Do not include sensitive user data, destructive payloads, or active exploits deployed against our production services.

Authorized Scope

Security research based on reviewing our public GitHub source code is permitted without prior authorization.

Researchers may reproduce findings in their own locally hosted instances of Claper.

Our production services (claper.co, app.claper.co), origin servers, and underlying infrastructure are not authorized security testing targets.

Any testing of these systems requires our prior written authorization, explicitly defining the permitted scope and testing window.

If you notice a potential vulnerability during normal use of Claper, you may report it privately. Do not perform additional intrusive testing.

Reports We Do Not Accept

We do not review:

• AI-generated or automated scanner reports without independent manual verification and demonstrated impact.
• Speculative, theoretical, or non-reproducible findings.
• Vulnerabilities already fixed in the latest release or current development branch.
• Duplicate reports without new technical evidence.
• Findings relating to third-party services or self-hosted instances operated by others.
• Reports based on unauthorized testing of our production systems or infrastructure.
• Reports submitted primarily to solicit payment or security consulting services.

Reports that fail to meet these requirements may be closed or ignored without response.

Prohibited Activities

Without explicit prior written authorization, the following activities are prohibited:

• Automated vulnerability scanning or penetration testing against Claper production services.
• AI-driven mass scanning or high-volume security testing.
• Attempting to exploit vulnerabilities on production systems.
• Accessing, modifying, or extracting other users’ data.
• Denial-of-service, load testing, or activities that disrupt availability.
• Circumventing authentication, rate limits, firewalls, or other security controls.
• Directly targeting origin servers or internal infrastructure.

This policy does not grant permission to test production systems.

We reserve the right to restrict access or take appropriate action in response to abusive or unauthorized activity.

No Bug Bounty Program

Claper does not operate a public bug bounty program.

We do not offer payments, rewards, or cryptocurrency for unsolicited vulnerability reports.

Submitting a report does not create any entitlement to compensation. Please do not submit reports with the expectation of payment.

Coordinated Disclosure

We ask researchers to report vulnerabilities privately and allow a reasonable remediation period before public disclosure.

We generally request up to 90 days to investigate and address confirmed vulnerabilities. Researchers should coordinate public disclosure with us where possible.

We do not guarantee individual responses to reports that fall outside this policy.

Security Contact

For qualifying security reports or security-related concerns:

alex@claper.co

Source code: github.com/ClaperCo/Claper