--- title: A “private and secure” face-search tool left 9 million... description: A people-search service called ClarityCheck, which markets itself as offering 'private and secure' reverse image searches, left an unprotected storage bucket... canonical: https://daily.dev/posts/a-private-and-secure-face-search-tool-left-9-million-photos-exposed-cn4tdoluf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A “private and secure” face-search tool left 9 million photos exposed | daily.dev og:description: A people-search service called ClarityCheck, which markets itself as offering 'private and secure' reverse image searches, left an unprotected storage bucket... og:url: https://daily.dev/posts/a-private-and-secure-face-search-tool-left-9-million-photos-exposed-cn4tdoluf og:image: https://api.daily.dev/og/posts/cN4TdoLuF.png og:image:alt: A “private and secure” face-search tool left 9 million photos exposed og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A “private and secure” face-search tool left 9 million photos exposed **[The Next Web](https://daily.dev/sources/tnw)** · 5 min read · 0 upvotes · 0 comments ## Summary A people-search service called ClarityCheck, which markets itself as offering 'private and secure' reverse image searches, left an unprotected storage bucket exposing over 9 million photos, including faces, profile pictures and screenshots of adults, teens and children. Security researcher Jeremiah Fowler found the 450GB store reachable via a web address embedded in the site's own code, requiring no password. A separate flaw let anyone manipulate certain URLs with a person's name to surface possible emails, phone numbers and addresses. Fowler also found files with timestamps exceeding the company's stated 14-day retention limit. ClarityCheck disputed calling the data 'publicly exposed' since the link wasn't indexed, but has since restricted access. No evidence of malicious access was found, though no logs existed to confirm this. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many photos were exposed in the ClarityCheck data breach? More than 9 million image files, totaling about 450GB of data, were left exposed in an unprotected online storage bucket belonging to ClarityCheck, a face-search and people-lookup service. The files, found by security researcher Jeremiah Fowler, included profile photos, screenshots, and images of adults, teenagers and children, many stored in folders labeled 'faces' and 'profiles'. _daily.dev surfaces breach reports like this for teams tracking exposure of user data and biometric images._ ### How was the ClarityCheck photo database exposed without being hacked? The storage bucket required no password and was reachable through a web address that a security researcher found embedded in ClarityCheck's own public website code. Search engines never indexed the link, but anyone who obtained it could access the files directly, since there was no authentication layer protecting them. _Developers auditing storage bucket configurations follow findings like this via daily.dev to avoid similar misconfigurations._ ### Did ClarityCheck keep uploaded photos longer than its stated privacy policy allows? Possibly yes. Researcher Jeremiah Fowler reported finding files with timestamps that exceeded ClarityCheck's stated 14-day limit for retaining uploaded images, suggesting the company may have held some images beyond its own retention policy. ClarityCheck did not address the retention issue in its public statement. _daily.dev helps privacy-minded engineers keep tabs on how vendors handle data retention claims versus practice._ ## Similar posts on daily.dev - [A hotel check-in system left a million passports and driver’s licenses open for anyone to see](https://daily.dev/posts/a-hotel-check-in-system-left-a-million-passports-and-driver-s-licenses-open-for-anyone-to-see-ogeugs0m5) · TechCrunch · 0 upvotes · 0 comments - [Former Meta engineer probed over 30,000 private Facebook photos](https://daily.dev/posts/former-meta-engineer-probed-over-30-000-private-facebook-photos-iakdmkp1a) · The Next Web · 0 upvotes · 0 comments - [UK Visa Portal exposed thousands of applicants’ passports and selfies — then called the lawyers on us](https://daily.dev/posts/uk-visa-portal-exposed-thousands-of-applicants-passports-and-selfies-then-called-the-lawyers-on-u-5gqs69q3t) · TechCrunch · 0 upvotes · 0 comments - [Gyazo server flaw exploited to steal 23.6 million user records](https://daily.dev/posts/gyazo-server-flaw-exploited-to-steal-23-6-million-user-records-qtq1enmyk) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#privacy](https://daily.dev/tags/privacy), [#data-breach](https://daily.dev/tags/data-breach), [#facial-recognition](https://daily.dev/tags/facial-recognition) [View this post on daily.dev](https://daily.dev/posts/a-private-and-secure-face-search-tool-left-9-million-photos-exposed-cn4tdoluf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A “private and secure” face-search tool left 9 million photos exposed","url":"https://daily.dev/posts/a-private-and-secure-face-search-tool-left-9-million-photos-exposed-cn4tdoluf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-private-and-secure-face-search-tool-left-9-million-photos-exposed-cn4tdoluf"},"datePublished":"2026-08-20T11:31:03.950Z","dateModified":"2026-08-20T11:31:28.449Z","description":"A people-search service called ClarityCheck, which markets itself as offering 'private and secure' reverse image searches, left an unprotected storage bucket...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cde0d4c173701eb1192e59161f77eaa7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cde0d4c173701eb1192e59161f77eaa7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-private-and-secure-face-search-tool-left-9-million-photos-exposed-cn4tdoluf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,privacy,data-breach,facial-recognition","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"A “private and secure” face-search tool left 9 million photos exposed"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a-private-and-secure-face-search-tool-left-9-million-photos-exposed-cn4tdoluf#faq","mainEntity":[{"@type":"Question","name":"How many photos were exposed in the ClarityCheck data breach?","acceptedAnswer":{"@type":"Answer","text":"More than 9 million image files, totaling about 450GB of data, were left exposed in an unprotected online storage bucket belonging to ClarityCheck, a face-search and people-lookup service. The files, found by security researcher Jeremiah Fowler, included profile photos, screenshots, and images of adults, teenagers and children, many stored in folders labeled 'faces' and 'profiles'. daily.dev surfaces breach reports like this for teams tracking exposure of user data and biometric images."}},{"@type":"Question","name":"How was the ClarityCheck photo database exposed without being hacked?","acceptedAnswer":{"@type":"Answer","text":"The storage bucket required no password and was reachable through a web address that a security researcher found embedded in ClarityCheck's own public website code. Search engines never indexed the link, but anyone who obtained it could access the files directly, since there was no authentication layer protecting them. Developers auditing storage bucket configurations follow findings like this via daily.dev to avoid similar misconfigurations."}},{"@type":"Question","name":"Did ClarityCheck keep uploaded photos longer than its stated privacy policy allows?","acceptedAnswer":{"@type":"Answer","text":"Possibly yes. Researcher Jeremiah Fowler reported finding files with timestamps that exceeded ClarityCheck's stated 14-day limit for retaining uploaded images, suggesting the company may have held some images beyond its own retention policy. ClarityCheck did not address the retention issue in its public statement. daily.dev helps privacy-minded engineers keep tabs on how vendors handle data retention claims versus practice."}}]} ```