In scope
- Anything that creates, duplicates or moves coins, gems or items without the matching rules — for example selling an item twice, opening a case without paying, or claiming a reward twice.
- Predicting or influencing case, battle or contract results before they happen, or a mismatch between a revealed seed and a result.
- Account takeover, session theft, cross-site scripting, request forgery, or reading another player's data.
- Bypassing the site lock, the 18+ confirmation or promo-code limits.
Out of scope
- Denial-of-service, load testing, spam or social engineering of people.
- Reports from automated scanners without a working proof of concept.
- Missing security headers or best practices with no real impact.
- Anything that requires a compromised device or browser.
Rules
- Use your own test accounts and never touch other players' data.
- Stop at the minimum needed to prove the issue and report it right away.
- Keep it private until we've fixed it and agreed on disclosure.
- DragonDrop is a demo with virtual coins: we can't pay cash rewards today. Valid reports get credit on this page if you want it, and demo coins.
Report
Describe the steps to reproduce, what you expected and what happened. One issue per report.