Security

Last updated: July 25, 2026

How we protect your data

• Sign-in is handled by Clerk, a specialist provider: Klyro never sees or stores your password, and two-step verification is available on your account.
• Every request is checked against a short-lived signed token from Clerk, verified on our servers with Clerk's public key, so it can't be forged or edited. Expired tokens and tokens issued for another site are refused.
• Accounts made before this change may still hold an old salted scrypt password hash until the account is moved to the new sign-in; the hash is deleted at that moment. Repeated wrong guesses are rate-limited.
• All traffic is served over HTTPS.
• Discord and Roblox client secrets are stored server-side only, as environment variables — never shipped to the browser.
• Database access runs through server-side functions with credentials that are never exposed to the client.

Responsible disclosure

If you believe you've found a security vulnerability in Klyro, please report it privately before disclosing it publicly, so we have a chance to fix it first.

• Report to: security@klyro.team
• Please include: steps to reproduce, affected URL(s), and impact if known.
• What to expect: we'll acknowledge reports as quickly as we reasonably can and keep you updated as we investigate.

We won't take legal action against good-faith security research that follows this process and doesn't access, modify, or exfiltrate other users' data.

If something goes wrong

If we find that personal information has been accessed without permission, we'll act quickly to stop it, and we'll tell the people affected and the authorities as the law requires, including under New York's SHIELD Act, without unreasonable delay.

Reporting a vulnerability

If you find a security problem, please email legal@klyro.team with the details, give us a reasonable chance to fix it before you share it publicly, and don't access other people's data or disrupt the service while testing. We won't take action against people who report in good faith and follow these rules. This is a hobby project, so we can't offer rewards, but we'll say thank you.

Scope

This covers Klyro's own web application and API. Vulnerabilities in Discord's or Roblox's own platforms should be reported directly to them.