Dracon takes the security of its products and customer data seriously. This page summarizes our security posture and our responsible-disclosure process.
If you believe you've found a security issue in a Dracon product, please email security@dracon.uk with a reproduction and the affected version. We respond within five business days. Machine-readable contact details live at /.well-known/security.txt.
All Dracon services are reachable over HTTPS only. Authentication is handled through HttpOnly session cookies scoped to the relevant subdomain.
Persistent data (user accounts, billing, rankings cache) is stored in encrypted-at-rest managed databases.
Confirmed vulnerabilities are disclosed after a fix has been deployed to all affected surfaces. We credit reporters with their consent.