Security DisclosureLast updated: 22 October 2026

This page explains how we protect Code Bin and the data you store in it, and how to report a security problem to us.

Report a vulnerability

If you think you’ve found a security vulnerability, please email [email protected] with:

  • a description of the issue and where it is;
  • the steps needed to reproduce it; and
  • what an attacker could do with it, if you know.

Please don’t report security issues in public places such as GitHub issues or Discord. We’ll acknowledge your report within five working days and keep you updated while we fix it. With your permission, we’re happy to credit you once it’s fixed. We don’t currently offer paid rewards.

Good-faith research

We won’t take legal action against you or ask anyone else to, for research that follows these rules:

  • only test with your own accounts and pastes, and don’t access, change or delete other people’s data. If you come across someone else’s data by accident, stop and tell us;
  • don’t run denial-of-service attacks, spam, social engineering or physical attacks;
  • give us a reasonable time to fix the issue before you tell anyone else about it.

Our services are hosted by third parties such as Clerk and Supabase. Vulnerabilities in their platforms should be reported to them.

How we protect your data

  • Encryption in transit. All traffic to Code Bin uses HTTPS.
  • Accounts. Sign-in is handled by Clerk, a specialist authentication provider. Code Bin never sees or stores your account password.
  • Paste passwords are stored as bcrypt hashes. Paste passwords set on our previous version of the site are converted to hashes when the paste is next unlocked.
  • Database access. The database can only be reached from our servers, and its access keys are never sent to your browser.
  • Private pastes can only be viewed by their owner. Our access to them is limited to the situations described in our Terms of Service.

No system is perfectly secure. If a data breach puts your rights at risk, we’ll tell you and the Information Commissioner’s Office as required by UK data protection law.

Contact

Security reports: [email protected]. For questions about your personal data, see our Privacy Policy.