Security details

Security posture

DraftWolfs is deployed on Vercel over HTTPS. Source ingestion runs on the server, and public browser code does not receive sportsbook credentials or service-role secrets.

The current release is a public rankings product. Authentication, account records, private league data, and multi-user draft rooms are not enabled.

Secrets and configuration

Secrets belong in local environment files or managed deployment secrets, never in source control. Public client configuration must be separated from server-only credentials. Service-role, API, and provider credentials must remain server-side.

Data handling

Source responses are cached and normalized before being displayed. Failed or stale sources are reported rather than silently replaced with invented values. Request timeouts and source status handling reduce exposure to unreliable upstream services.

Development controls

Changes are reviewed through GitHub, verified by the production build, checked for high-severity dependency vulnerabilities in CI, and deployed through the Vercel delivery workflow.

Responsible disclosure

If you believe you found a security issue, do not publish exploit details or send credentials. Contact security@draftwolfs.com with the affected URL, a concise description, reproduction steps, and any relevant logs with secrets removed.

Scope note

This page describes the current web release and is not a guarantee of security for third-party platforms or source providers. It is a product draft and should be reviewed by qualified counsel and a security professional before App Store publication.