Tools & Comparisons

Clerk Auth: The unsafe_metadata Footgun

Clerk's unsafe_metadata field is client-writable by design. If your application security model reads role assignments from metadata without server-side validation, any authenticated user can escalate to admin. A practical penetration testing guide to finding and fixing this privilege escalation vulnerability.