Security

ClickCard handles account data, public card content, uploads, analytics, and payment workflows. Security controls should protect private dashboards while allowing public cards to render safely.

Current safeguards in the codebase

• Private dashboard pages require account login before access.
• Database access uses prepared PDO statements in core flows.
• Uploaded files are restricted by file type and size in the application layer.
• Public profile metadata avoids exposing private account-only information.
• User-generated external links are marked with rel="nofollow ugc" where rendered by the shared helpers.

Recommended operational controls

• Store production secrets in environment or host-managed secret storage.
• Rotate sensitive credentials on a regular operational schedule and after any suspected exposure.
• Keep production error display disabled and log errors privately.
• Add moderation and owner opt-in before allowing public profiles into search indexes.