Security Model

MyClaude protects users through 6 security layers: Firebase Auth with JWT tokens, Firestore security rules blocking direct client writes to sensitive fields, signed URLs for paid file downloads (5-minute expiry), CSRF middleware on all mutations, automated content scanning with 22 malicious pattern detectors, and rate limiting on all API mutation routes. No single control protects everything — a bug in one layer cannot bypass the others.

Authentication

Every user session is backed by Firebase Authentication. When you log in, Firebase issues a JWT (JSON Web Token) that is valid for 1 hour and automatically refreshed client-side.

Unauthenticated users can browse public product listings. Any action that writes data — purchasing, publishing, downloading a paid file — requires a valid token.

Authorization

MyClaude uses a dual Firebase SDK architecture. The server-side Admin SDK handles all privileged operations; the client-side SDK is scoped to public reads and authenticated user operations.

Every API route that performs a mutation follows this verification sequence:

1. Extract Authorization: Bearer {token} from request headers
2. Call admin.auth().verifyIdToken(token) — rejects expired or tampered tokens
3. Use the decoded UID to confirm the caller is authorized for the requested resource
4. Return 401 Unauthorized if the token is missing, expired, or invalid

Data Protection

Firestore security rules enforce ownership at the database layer, independent of application logic. This means a bug in application code cannot grant a user access to another user's private data.

Sensitive fields — such as raw Stripe account identifiers and internal file storage paths — are never included in client-facing API responses.

File Storage

Product files for paid products are never exposed directly to the browser. File URLs in Firestore are admin-only fields.

The download flow:

User clicks Download
  → POST /api/products/download (with auth token)
  → API verifies token
  → For paid products: confirms purchase order exists for this user + product
  → For free products: allows immediately
  → Generates a signed URL (5-minute expiry, single-use intent)
  → Returns URL → Client opens in new tab

Content Scanning

Every product submitted via myclaude publish passes through the CONDUIT pipeline before appearing on the marketplace. The pipeline runs myclaude scan against the product bundle.

Products that fail any scan are rejected before listing. Creators receive a specific error message identifying the violation.

Payment Security

Payments are processed entirely by Stripe. MyClaude never handles raw card data.

Orders are created exclusively by the Stripe webhook handler. There is no client-side code path that can create an order. A buyer purchasing a product through any means other than Stripe checkout will not receive a valid order record, and will be denied file access.

Rate Limiting

All mutation API routes are protected by server-side rate limiting to prevent abuse.

Related pages

• Vulnerability Disclosure — how to report security issues
• Trust & Safety — content enforcement and marketplace integrity
• Content Policy — prohibited content rules