Log inGet started

Security

DASHUND is published by a French business. This page is a translation provided for convenience: French law applies, and if the English and French versions differ, the French version prevails.

Report a vulnerability

Think you’ve found a vulnerability in DASHUND? Email us at contact@dashund.link with “Security” in the subject line. Please include:

  • the affected part (web app, test links, Figma plugin) and the page address;
  • the steps to reproduce the issue, and what you observed;
  • its impact as you see it, and how to reach you.

Our commitments

  • Every report is read and answered, usually within a few business days.
  • Confirmed vulnerabilities are fixed as a priority, and we let you know once they are fixed.
  • If you wish, we can thank you publicly once the vulnerability is fixed.

Rules of engagement

If you look for vulnerabilities in good faith, we ask that you:

  • only use your own accounts, and never access, modify or delete other people’s data;
  • do not disrupt the service (no denial of service, no mass sending, no spam);
  • do not target our users or our providers (no phishing, no social engineering);
  • give us a reasonable amount of time to fix the vulnerability before any disclosure.

Scope: the app.dashund.link web app, the dashund.link website and test links, and the DASHUND plugin for Figma. The services of Figma, our hosting providers and our other providers fall under their own reporting programs.

Measures in place

  • Hosting in Europe: data is hosted by OVHcloud, in France. All connections are encrypted (HTTPS, with HSTS).
  • Testers are not identified: testers have no account and share neither a name nor an email address; they are only associated with a random identifier, unique to each prototype. Their IP address is only processed transiently, in memory, to determine the country of connection and to limit abuse; it is never recorded in analytics data or in logs.
  • Technical logs: they contain no IP address, their size is capped, and the oldest entries are deleted automatically after a few days.
  • Backups: made every night, encrypted and kept for 6 months at most; restoring them is tested.
  • Accounts: passwords are never stored in plain text, but in a salted, hashed form (scrypt algorithm) that cannot be reversed; the email address is verified before any account is created; login and password reset links are single-use and expire quickly; the number of login attempts is limited; logging in with Google or Microsoft is only accepted for an email address verified by that provider.
  • Workspace isolation: access rights are checked on every request; automated tests verify that every feature of the application denies access to a user outside the workspace and allows no changes by a read-only member.
  • Figma plugin: it never has access to your password; once you have authorized it in your browser, it receives a random, revocable access token, and sends no data until you click “Publish”.
  • Secrets and access: login, invitation and API access tokens are only stored in hashed form; access keys to our providers’ services never appear in the source code; administration of the service is restricted to a named list of accounts, and the databases cannot be reached from the internet.
  • Third-party components: the software libraries we use are checked automatically (known vulnerabilities and licenses) with every code change.
  • Incidents: in the event of a personal data breach, we inform the affected customers under the conditions set out in the data processing agreement.

No measure can guarantee absolute security: we strengthen these measures over time and fix the vulnerabilities reported to us as a priority.

For the protection of personal data and how to exercise your rights, see the privacy policy.

Last updated: October 31, 2026.