Updates

February 2026

• We finished our work on a fully automated account registration process. Please review the "Account access" section in this program. With the switch to the new process, we also fully reset the existing environment. This means, that you need to register again using the new process. Apologies for any inconvenience.

December 2025

• Enabled Leaks and exposed credentials
• Enabled Systemic Issues grid

June 2025

• Added clarification to the bug bounty brief requiring demonstrable impact for XSS reports beyond simple alert pop-ups.

May 2025

• We will move the DRACOON bug bounty program under the Kiteworks umbrella shortly while we do some organisational re-arrangements. This will not have any effect on this program except that the brand Kiteworks will have increased visibility.
• We declared an end of life date for DRACOON Server. As a result we will no longer pay bounty for findings of low or medium severity based on CVSS. The bounty for findings of high or critical severity remain unchanged. This change only affects DRACOON Server and not DRACOON Cloud. This change is reflected in the program description as well as the reward grid introducing a new medium tier for all assets related to DRACOON Server.

DRACOON

DRACOON offers secure file sharing and collaboration services with two products, DRACOON Cloud and DRACOON Server. Both products support built-in end-to-end encryption and offer many features tailored for large organizations, such as a complex roles and permissions system, SSO integration, auditing and reporting features.

With this bug bounty program, we want to reinforce our commitment to security and reward security researchers for helping us protect our customers' data.

Program Rules

DRACOON wants to increase the security of its products by inviting security researchers to analyze the implementation of security measures in its product and to identify existing vulnerabilities. In order to achieve this goal together, it is important to us that the following rules are adhered to.

• (D)DoS attacks on our infrastructure are strictly prohibited. This includes (but is not limited to) all applications, services, servers and network infrastructure.
• Do not carry out load-based attacks (e.g. automated scanners that create a large number of requests).
• Do not interfere with any box that is not listed within the program scope.
• Do not decommission any boxes.
• Do not change network configuration.
• Do not change passwords of accounts (unless it’s your own) or delete other accounts.
• Do not extract information and disclose it if you should gain access to it irregularly.
• Do not alter, modify or delete any information stored in our cloud if you should gain access to it irregularly.
• Do not publish (even partially) any vulnerabilities that are found.

Reward Eligibility

We are happy to thank everyone who submits valid reports to improve the security of our cloud service, however only those that meet the following eligibility requirements may receive a monetary reward:

• You must be the first reporter of a vulnerability.
• The vulnerability must be a qualifying vulnerability (see below).
• Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through http://yeswehack.com.
• The vulnerability report must contain the following elements:
  1. A clear textual description of the vulnerability, how it can be exploited, its security impact and remediation advice.
  2. A proof of the exploitation of the vulnerability (e.g. screenshots, proof of concept code).
  3. The preconditions and steps required to reproduce the issue including code snippets, commands, request information, payloads, etc.
• You must not be a former or current employee of our company or one of its contractors.
• As DRACOON Cloud and DRACOON Server share the majority of the source code, we consider the same attack on both systems in scope as duplicate.
• DRACOON Server has a declared end of life date. This means that we will not pay bounty for findings of low or medium severity based on CVSS.

XSS Reporting Requirements

Please note that for any reports involving Cross-Site Scripting (XSS), a basic proof-of-concept such as a JavaScript alert box (e.g., alert(1)) will not be considered sufficient for triage or reward. To qualify for a valid report, you must demonstrate a clear and actionable impact resulting from the XSS vulnerability. This includes, but is not limited to:

• Performing actions on behalf of another user (e.g., creating a new user account or modifying user settings)
• Exfiltrating sensitive data (e.g., sending authentication cookies or session tokens to an external server)
• Bypassing security controls or escalating privileges

The goal is to understand the real-world risk and exploitability of the issue, so please ensure your report includes a well-documented and impactful demonstration.

DRACOON Infrastructure Overview

Description of services

Services in scope

Core - This service is the heart of the backend. It is responsible for file upload, download, sharing, user and role management.
OAuth - Responsible for user authentication. Implements OAuth2.
S3 Storage - Storage location of binary data. Accessible via internet and heavy use of pre-signed S3 URLs to allow direct transfer between client app and storage.
Media - Responsible for image downscaling (e.g. for thumbnails).
Reporting - Responsible for generating various reports triggered by the user (e.g. reports on user activity). Creates PDF and CSV files.
WebDAV - Proxy service that allows to connect to DRACOON via WebDAV protocol.

Services out of scope

Branding - Allows customers to customize appearance. Manages customer branding configurations (e.g. logo, email signatures).
Signing - Acts as a proxy to our signing partner FP-Sign. Responsible for sending signing requests and storing signed documents in DRACOON.

Description of clients

Clients in scope

Web App - The main web application to access DRACOON via a browser. This is the only full-feature client.

Clients out of scope

Desktop Apps - Sync client for Windows and Mac. Mounts DRACOON as a virtual disk on the end user’s device.
Mobile Apps - Native apps for Android and iOS, that provide a subset of the features.
MS Teams App - App for MS Teams.
Outlook Add-In - Add-In for MS Outlook. Allows to convert attachments to share links.
Swagger UI - Swagger UI is an interactive API documentation. Most services provide a public Swagger UI client. See useful links section.

Useful links

• Bug Bounty Environments:
  • DRACOON Cloud: https://bounty-cloud.dracoon.app
  • DRACOON Cloud S3 Storage https://0-2744452194.s3.nbg01.de.dracoon.io
  • DRACOON Server: https://bounty-server.dracoon.app
• User manuals, knowledge base:
  • DRACOON Cloud: https://cloud.support.dracoon.com
  • DRACOON Server: https://server.support.dracoon.com
• Public API documentation (SwaggerUI / OpenAPI 3.0):
  • DRACOON Cloud
    • Core Service: https://bounty-cloud.dracoon.app/api
    • Reporting Service: https://bounty-cloud.dracoon.app/reporting/api
  • DRACOON Server
    • Core Service: https://bounty-server.dracoon.app/api
• Public SDKs and crypto implementation: https://github.com/dracoon
• Whitepaper on e2e encryption: https://cloud.support.dracoon.com/hc/en-us/articles/360000986345-Whitepaper-Client-side-Encryption