People-search platforms and identification services have expanded rapidly by aggregating public records, contact registries, and algorithmic facial recognition. As these platforms process massive volumes of sensitive personal information, their underlying storage architectures often lag far behind enterprise-grade security standards. When reverse-lookup systems fail, they expose not just temporary credentials, but immutable biometric markers that cannot be rotated or reset like compromised passwords.
Unsecured Cloud Buckets and Biometric Leaks
The people-search tool ClarityCheck, which advertises to users that reverse image searches remain private and secure, publicly exposed more than 9 million image files totaling roughly 450 GB.
Independent security researcher Jeremiah Fowler discovered the unprotected database inside an unsecured Amazon S3 bucket, where image assets were neatly categorized into folders named “faces” and “profiles.” These files—spanning profile pictures, desktop screenshots, and photos of adults, teenagers, and children—were accessible to anyone online via direct URLs embedded within the platform's publicly available frontend code. Beyond raw visual imagery, a secondary misconfiguration exposed corresponding email addresses and phone numbers. As Fowler noted, the database appeared accessible for months before remediation took place, creating an unauthenticated repository primed for spear-phishing, automated surveillance, and identity de-anonymization.
“If you’re trying to find out who a person is, you might not have authorization or permission, so people might not know that their image had been dumped into this database that was public,” Fowler tells WIRED. “An AI bot could crawl it, extract faces, and use them for training.
And there are lots of pictures of kids in there.” This incident illustrates the operational fiction of consent in modern scraping pipelines. Although ClarityCheck requires uploaders to attest that they hold rights to submit images, the subjects whose biometric profiles are indexed and stored rarely know their physical likeness sits in an unauthenticated bucket.
Defining Exposure and Third-Party Risk
Following notification by WIRED in July, ClarityCheck restricted access to the S3 bucket and secured the exposed endpoints. A company spokesperson claimed the team acted immediately, while attempting to argue that the assets were never genuinely compromised because average internet users were unlikely to stumble across direct object URLs.
Industry standards and federal security frameworks firmly reject the notion that security through obscurity negates an exposure event. Storing raw biometrics in publicly accessible cloud object storage represents a total breakdown of boundary isolation principles. When enterprises integrate third-party identity and enrichment pipelines, architectural negligence in vendor storage propagates severe regulatory liability across the entire organization.
Technical leads must audit all third-party identity and data enrichment vendors for direct client-side S3 references and verify that external computer vision processing pipelines enforce strict server-side authentication rather than unindexed URL obscurity.