Security at MyClipCloud — Encryption, Sign-in and Devices

Account and sessions

Google sign-in uses OpenID Connect with state, nonce and PKCE checks; ID tokens are verified for signature, issuer, audience and expiry. We request only your basic profile and email.
Email sign-in: passwords are hashed with bcrypt, must be at least 10 characters, and common passwords are refused. New addresses must be confirmed by email. Repeated failed attempts lock the address for 15 minutes, and sign-in errors never reveal whether an account exists.
Changing or resetting your password signs out every other session and sends you an email notice.
Your account is tied to Google's stable account identifier, not to your email address.
Session cookies are HttpOnly, Secure and SameSite. The session identifier is replaced when you sign in.
You can remove any device or sign out of all other sessions; access ends immediately.

Clipboard content is encrypted with XChaCha20-Poly1305 (libsodium). Each item is bound to its owner and record, and keys are kept outside the database and source code.
Expired and deleted items are hidden at once and purged from the database by a scheduled job. Backups follow their own limited retention.
Logs and the audit trail never contain clipboard content or credentials.
Administrators cannot view clipboard content in the admin tools.

Strict Content Security Policy, CSRF tokens and origin checks on every change, clickjacking protection and no third-party scripts.
Rate limits on sign-in, sync and contact endpoints.
Every item and device lookup is checked against the signed-in account on the server.
Copied text is always displayed as plain text, never executed as HTML.

Please report security issues through the contact form with the subject "Security". Do not include other people's data in reports.