A “Private and Secure” Face-Search Tool Left 9 Million Photos Exposed
ClarityCheck, a people-search tool that claims to offer private and secure reverse image searches, left over 9 million image files exposed, according to a security researcher. These photos included faces of adults, teenagers, and even children, many of whom may never have consented to their images being used.
August 20, 2026 – 11:20 am
Credit: Gibrán Aquino
A security researcher, Jeremiah Fowler, discovered an unprotected database containing approximately 450GB of data, accessible without a password. The database held millions of images labeled as "faces" and "profiles," including profile pictures, screenshots, and other personal photos.
The researcher reported his findings through ExpressVPN. This isn’t Fowler’s first time uncovering unsecured databases; he’s known for his work in this area.
How the Exposure Occurred
The database was accessible through a web address found in ClarityCheck’s public website code, which wasn’t indexed by search engines but had no security measures. The company has since restricted access.
Fowler couldn’t determine if anyone had downloaded the files due to a lack of access logs.
Additionally, it was possible to surface possible email addresses, phone numbers, and physical addresses by modifying certain ClarityCheck web addresses and entering a person’s name, a separate weakness that doesn’t involve the exposed image store.
The Sensitivity of the Issue
The sensitivity of this lapse lies in the service’s nature. ClarityCheck is designed to help users verify strangers and make informed decisions about online interactions. By uploading their own images, users trust the platform with their personal photos, which cuts against the service’s promise.
The incident is particularly awkward for a tool marketed as a means to identify catfishing and fake dating profiles.
Some of the images appeared to come from social media and dating profiles, raising concerns about the potential misuse of personal data.