Security

How we work

• Every part of Dekota is pinned to an exact version. We build our own images and test each release before publishing it.
• The console never updates itself and has no Update button. On the consoles we run, each update takes a backup first and returns to the previous version if its checks fail.
• Sign-in to dekota.org uses one-time codes sent to your email. Session tokens are kept in secure, HTTP-only cookies that scripts on the page cannot read.
• This site sets a strict content security policy, loads no third-party scripts and uses no tracking cookies.

Responsible disclosure

If you find a security problem in Dekota or on dekota.org, tell us privately first. Email security@svayam.uk or use the form on this page. Include the steps to reproduce it, the impact you think it has and how to reach you.

Our promise: we reply within 2 working days, keep you updated while we fix it, credit you publicly if you would like, and will not take legal action against research done in good faith under these rules.

The rules: do not access, change or delete other people's data; use your own accounts. Do not run denial-of-service, spam or social engineering tests. Give us 90 days to fix the problem before you publish details.

Machine-readable details: /.well-known/security.txt