Security & data
Last updated:
Raccoon handles sensitive information such as Cloudflare tokens and evidence about impersonating sites. These are the measures currently in place.
Accounts and sign-in
- Passwords are never stored in readable form — only a scrypt hash is kept.
- Sessions use a signed token stored in an HttpOnly cookie (JavaScript on the page cannot read it).
- Password reset is available through the registered email address.
Cloudflare tokens and API keys
- Cloudflare tokens you connect are encrypted with AES-256-GCM before they are stored, and decrypted only on the server when a Cloudflare call is needed.
- Raccoon uses a token only for the actions you request (reading domains, creating/removing redirects, setting canonicals). Create tokens with the minimum permissions shown in the app.
- You can remove a connection at any time; revoke the token on Cloudflare when you no longer need it.
Data separation
Data belongs to an account: Cloudflare connections, redirects, canonicals, watch lists, activity logs and evidence of one account can only be seen and changed by that account.
Infrastructure
- The application runs on DigitalOcean App Platform (Singapore region) and is served over HTTPS.
- Data is stored in a PostgreSQL database over an SSL-encrypted connection.
- Server secrets are kept as encrypted environment variables, never in the source code.
Activity log
Important actions (creating/removing redirects, setting canonicals, deleting domains…) are written to the account’s activity log so you can see who did what and when.
Reporting a vulnerability
If you find a vulnerability, please email a description and steps to reproduce to [email protected] with a subject starting with [Security]. Please give us time to fix it before disclosing it publicly, and do not access or modify other users’ data while testing.