Security Model

MyClaude protects users through 6 security layers: JWT-based authentication, database-level ownership rules blocking unauthorized access to sensitive fields, signed URLs for paid file downloads (5-minute expiry), CSRF middleware on all mutations, automated content scanning with 22 malicious pattern detectors, and rate limiting on all API mutation routes. No single control protects everything — a bug in one layer cannot bypass the others.

Authentication

Every user session is backed by Firebase Authentication, which is independent from Anthropic's own authentication systems. MyClaude manages its own user accounts and sessions via Firebase Auth.

When you log in, Firebase issues a JWT (JSON Web Token) that is valid for 1 hour and automatically refreshed client-side.

Unauthenticated users can browse public product listings. Any action that writes data — purchasing, publishing, downloading a paid file — requires a valid token.

Authorization

MyClaude uses a dual-layer architecture. The server handles all privileged operations with full data access; the client is scoped to public reads and authenticated user operations.

Every API route that performs a mutation follows this verification sequence:

1. Extract Authorization: Bearer {token} from request headers
2. Verify the token server-side — rejects expired or tampered tokens
3. Use the decoded UID to confirm the caller is authorized for the requested resource
4. Return 401 Unauthorized if the token is missing, expired, or invalid

Data Protection

Database security rules enforce ownership at the data layer, independent of application logic. This means a bug in application code cannot grant a user access to another user's private data.

Sensitive fields — such as raw Stripe account identifiers and internal file storage paths — are never included in client-facing API responses.

File Storage

Product files for paid products are never exposed directly to the browser. Raw file URLs are admin-only fields, never included in client-facing responses.

The download flow:

User clicks Download
  → POST /api/products/download (with auth token)
  → API verifies token
  → For paid products: confirms purchase order exists for this user + product
  → For free products: allows immediately
  → Generates a signed URL (5-minute expiry, single-use intent)
  → Returns URL → Client opens in new tab

Content Scanning

Every product submitted via myclaude publish passes through the CONDUIT pipeline before appearing on the marketplace. The pipeline runs myclaude validate against the product bundle.

Products that fail any scan are rejected before listing. Creators receive a specific error message identifying the violation.

Payment Security

Payments are processed entirely by Stripe. MyClaude never handles raw card data.

Orders are created exclusively by the Stripe webhook handler. There is no client-side code path that can create an order. A buyer purchasing a product through any means other than Stripe checkout will not receive a valid order record, and will be denied file access.

Rate Limiting

All mutation API routes are protected by server-side rate limiting to prevent abuse.

Related pages

• Vulnerability Disclosure — how to report security issues
• Trust & Safety — content enforcement and marketplace integrity
• Content Policy — prohibited content rules
• Claude Code documentation — official Claude Code reference from Anthropic