Security & incident reporting

Report a concern

Email hello@lakhinacouture.com with subject “Drift security incident”. Include affected page, approximate time, a short description and safe reproduction steps. Do not include credentials or another person’s data. Stop testing if you encounter private information; do not extract, alter or publish it. No paid bug-bounty or testing authorisation is created by this notice.

Current controls

Drift uses HTTPS for delivery, purpose-specific consent, a hashed browser token for optional measurement, server-side owner checks for administration and restricted aggregate exports. Private APIs are marked non-cacheable. Security cannot be guaranteed; report suspected access issues promptly.

How incidents are handled

The operator must assess reports, contain exposure, investigate affected records, preserve appropriate evidence, involve processors where needed, and provide notifications required by applicable law. Where an incident requires notification, communications should explain the nature of the incident, likely consequences, mitigation and protective steps, and a contact for help. These actions require an operational response; this website does not automatically detect or report every incident.

Because anonymous play does not collect player contact details, we may have no email address with which to contact a player directly. This must be considered when assessing notification channels for an actual incident.