Security

Effective Date:  |  Last Updated:

We take data security seriously. SnippKit uses industry-standard practices to protect your account and code snippets.

Authentication is handled securely with modern identity standards via Clerk. All network traffic is encrypted over HTTPS/TLS 1.3, and data is stored in Supabase with role-based access control and strict isolation policies.

Encryption Architecture

Transit Encryption: Data transmitted between your browser and our servers uses HTTPS with TLS 1.3 encryption.

At-Rest Encryption: Private code snippets, encrypted tasks, and user keys are stored in Supabase encrypted at rest using AES-256-GCM authenticated encryption with unique initialization vectors (IV). Public snippets intentionally bypass AES encryption so they can be rendered publicly, embedded, and indexed.

Authentication & Database Authorization

Identity management, single sign-on (SSO), and session token validation are managed by Clerk. Database query authorization relies on Supabase Row-Level Security (RLS) policies to ensure private items can only be accessed by authorized owners or team members.

Web Security Controls

• HTTPS Enforcement: Secure connections enforced across all API endpoints and pages.
• XSS & CSRF Mitigation: React escaping, HttpOnly session cookies, and anti-CSRF token verification protect against client-side injection.
• Security Protection Headers:

Infrastructure & Supabase Storage

SnippKit is hosted on Vercel edge infrastructure and Supabase (Postgres Database & Supabase Storage). Uploaded assets undergo MIME-type validation.

Secret Handling & Leak Safeguards

We strongly recommend that you do not store sensitive personal or production credentials inside snippets, especially in public ones. Our tool, LaunchGuard, provides privacy-first pre-push checks to help prevent accidental credential leaks before deployment.

API Throttling & Rate Limiting

API endpoints and AI routes utilize Upstash Redis sliding-window rate limiters to prevent brute-force attacks and automated API abuse.

AI Security

Code submitted to AI features (OpenAI, Gemini, Together AI) is processed transiently over encrypted API connections and is not used to train public foundation models.

Vulnerability Reporting & Disclosure

If you discover a security vulnerability or bug, please report it to our security team following responsible disclosure practices:

Security Email:
Security Contact:
Response Timeframe:
Bug Bounty Details:
PGP Key:

You may also report security issues via our contact page.