At CALCAR, security is fundamental to our platform. We implement cryptographic commit-reveal verification, optional on-chain anchoring (off by default), and layered platform security practices to protect the integrity of every rodeo draw.
Technical Security
HTTPS/TLS: All communications encrypted with TLS 1.2+
HSTS: HTTP Strict Transport Security enforced for 1 year
CSP: Content Security Policy restricts script sources and prevents XSS
Cryptographic Hashing: Draw inputs are hashed and committed before the seed is revealed; executed draw records are protected against modification by database triggers
Smart Contracts (optional, when enabled): When on-chain anchoring is turned on for an event, commit and reveal hashes can be anchored to a public contract so the sequencing of "inputs locked" before "seed revealed" is checkable on-chain. Anchoring is off by default and is only claimed for a draw whose verification page shows a real chain and transaction hash. The shuffle itself always runs off-chain (deterministic SHA-256 seeded Fisher-Yates) and can be re-run by anyone from the published seed
Data Protection
Encryption at Rest: Sensitive data encrypted with AES-256
Encryption in Transit: All data transmission encrypted end-to-end
Access Control: Role-based access control (RBAC) for all operations
Audit Logging: Comprehensive logging of all administrative actions
Public Verification: All draw data independently verifiable without authentication
Security Practices
Ongoing Review: Internal security review, dependency scanning, and third-party audits as the platform scales
Vulnerability Management: Responsible disclosure and prompt patching
Security Headers: HSTS, X-Frame-Options, X-Content-Type-Options, and others
Incident Response: Error monitoring with documented escalation and response procedures
Standards: Built against widely accepted web security practices; no formal certification is claimed
Report a Vulnerability
If you discover a security vulnerability, please responsibly disclose it to our security team at security@rodeo1.app rather than posting publicly.
We take all security reports seriously and will work with you to verify and fix the issue quickly.
Draw Integrity
Every draw uses a cryptographic commit-reveal process, independent of blockchain, to ensure:
Inputs (cowboys and stock) are hashed and committed before the seed is generated
Public verification of draw outcomes — anyone can re-run the recomputation, no account required
Cryptographic proof data for independent auditing on the Verify page
On-chain anchoring is an optional add-on and is not enabled by default. A draw only carries the "on-chain anchored" badge when its verification page shows a real chain and transaction hash. The guarantee we stand behind for every draw is the off-chain SHA-256 commit-reveal proof and independent recomputation.