Security
This page explains what draw.fun does and does not custody, and how to report security issues responsibly.
What we custody / don’t custody
- We do not custody your wallet. We do not control your wallet private keys or seed phrase, and we will never ask you to share them.
- Inscriptions: when you create an inscription, you pay into a draw.fun deposit address. draw.fun temporarily holds those funds to complete the inscription (miner fees + service fee) and related operational steps.
- Marketplace: the marketplace uses draw.fun-controlled wallets to hold funds temporarily during escrow/settlement and cancellation flows.
- Blockchain finality: blockchain transactions are irreversible. If you send funds to the wrong address, we may not be able to recover them.
How to report a vulnerability
Email: [email protected]
Subject line: [SECURITY] short description
Include:
- What you found and why it matters (impact)
- Exact steps to reproduce (URLs, parameters, example requests)
- Any relevant logs or screenshots (redact sensitive info)
- Whether you’ve shared it with anyone else
Response expectations
- We’ll acknowledge receipt within 72 hours.
- We’ll follow up with an initial assessment and next steps.
- For critical issues, we aim to ship a fix or mitigation within 7 days. For high severity, within 14 days. For medium severity, within 30 days.
- Please do not publicly disclose issues until we’ve had a chance to investigate and ship a fix.
Bug bounty / rewards
- No paid bug bounty is offered at this time.
- We’re happy to credit researchers (name/handle) on this page if desired.
- At our discretion, we may offer a small thank-you for impactful reports.
If you believe you’ve found a critical issue that could put users at immediate risk, say so in the subject line.