Security Policy

Effective date: 26 June 2026
Last updated: 28 July 2026

1. Security Architecture & Principles

Dropframe is engineered with defense-in-depth principles on Cloudflare's serverless edge infrastructure. By eliminating traditional web servers, virtual machines, and persistent backend daemons, we maintain a minimal attack surface.

Client / AI Assistant (MCP)
           │
           ▼  (Enforced HTTPS / TLS 1.3)
Cloudflare Workers & WAF
           │
  ┌────────┴────────┐
  ▼                 ▼
KV Storage       D1 Database
(App Bundles)    (Metadata & Hashes)

2. Infrastructure Security

Serverless Isolation: All code runs inside Cloudflare Workers V8 isolates, providing cryptographic memory isolation between execution requests.
Edge Storage: Deployed HTML content is stored in Cloudflare KV namespaces with strict key-level authorization.
DDoS Mitigation & WAF: Cloudflare's automated Web Application Firewall (WAF) filters malicious traffic, layer 7 attacks, and automated bot networks before they reach our application handlers.

3. Web Application Security & Sandboxing

3.1 Preview Frame Isolation

All deployed apps (dropframe.run/preview/{id}) are rendered inside an isolated, sandboxed iframe container:

sandbox="allow-scripts allow-forms allow-same-origin"

This strict browser-enforced boundary ensures guest applications:

Cannot break out to navigate the top-level parent window
Cannot read or write parent domain local storage, session cookies, or authentication states
Cannot trigger unauthorized pop-ups or top-level redirects

3.2 Authentication & API Protection

Session Tokens: Browser authentication is managed securely via Clerk JWTs over HTTPS.
MCP Credentials: MCP tokens (df_...) are transmitted over TLS and matched in database queries using SHA-256 cryptographic hashes. Plaintext keys are displayed once upon generation and are never stored in readable format.
Rate Limiting: API endpoints enforce IP-level and token-level rate limits to protect infrastructure capacity against brute-force attacks.

4. Responsible Disclosure Policy

We welcome security research on our platform. If you discover a vulnerability, we request that you report it to us responsibly before public disclosure.

4.1 How to Report a Vulnerability

Email: hello@dropframe.run
Subject line: Security Disclosure - [Vulnerability Type]
Include: Detailed description, steps to reproduce, HTTP request samples, and proof-of-concept code.

4.2 Guidelines for Researchers

Do not access, modify, or delete data belonging to other users.
Do not execute Denial of Service (DoS) or physical social engineering attacks.
Do not deploy live malware or phishing pages to production preview endpoints.
Allow us a reasonable timeframe (up to 30 days) to investigate and remediate the issue prior to public disclosure.

We do not currently offer cash bug bounties, but we will gladly credit researchers in our Security Hall of Fame upon request.

5. Contact

Email: hello@dropframe.run
Website: dropframe.run