← dfsroto

dfsroto data policy

Home-host source ingestion goes through src/policy/fetch.ts. It refuses, at runtime, anything below.

  1. Canonical input is the user's own DraftKings CSV. DK publishes an "Export to CSV" link on every contest. The app is fully functional with only that file. Nothing in the paid path depends on us fetching from DK.
  2. Public DK JSON is a convenience layer only. www.draftkings.com/lobby/getcontests and /lineup/getavailableplayers* — unauthenticated, the same URLs DK's own lobby page loads. Rate-limited to one request per 6 s per host. Never run from a datacenter IP.
  3. Denylist, enforced: api.draftkings.com, sportsbook*.draftkings.com, *.underdogfantasy.com, *.prizepicks.com. These are bot-walled by their operators; the wall is the answer. No proxies (HTTP_PROXY/HTTPS_PROXY/ALL_PROXY set → refuse to start), no stealth, no spoofed browser fingerprints.
  4. Never authenticated. policyFetch strips Cookie and Authorization headers. No logged-in scraping, ever.
  5. Honest User-Agent. dfsroto/<version> (+dfsroto.win/policy). If a host blocks that UA, we stop, we do not disguise. (Bisected 2026-09-16: DK's WAF rejects any UA containing https:// — a scanner-signature rule; curl/8.7.1 and no-UA both pass. So: no URL scheme in the string. Still named.)
  6. Home-IP guard. Ingest refuses to run unless egress IP matches DFSROTO_HOME_IP (or DFSROTO_ALLOW_ANY_IP=1 is set explicitly for local dev with cached data).
  7. Tool, not operator. dfsroto sells projections and lineups. It never takes entries, holds funds, or sets odds. No sportsbook affiliate links (state vendor registration territory).
  8. Open sources we lean on and why they are open: ESPN's public scoreboard (carries DK lines as provider), Pinnacle guest API, official MLB/NHL league APIs, nflverse (open data on GitHub), Kalshi's documented public API (CFTC-regulated exchange; open data is its business model).

Live multi-sport feeds

NFL, NBA, NHL and MLB game boards and live player statistics refresh from public ESPN data every five minutes. Each feed shows its last successful timestamp. A failed request preserves the last good data and is marked delayed.

DraftKings salary pools refresh separately from our home-IP publisher. Additional-sport targets begin at historical fantasy averages; they are not projections. NFL uses our existing projection model. User CSVs and lineup edits stay in the browser.

Test: test/policy.test.ts asserts every denylisted host is refused and every allowlisted host is rate-limited.