Security Vulnerability FAQ

Whether Luma is affected by publicly announced security vulnerabilities

When a major vulnerability is announced in a widely used language, framework, or library, we often get asked whether Luma is affected. This page answers those questions. For an overview of our security program, see Enterprise Security.

What Luma Is Built With

Here’s an overview of the main parts of our stack.

Backend: TypeScript running on Bun, deployed on AWS
Website: TypeScript and React with Next.js
Database: PostgreSQL
Mobile apps: Swift on iOS and Kotlin on Android
Edge: Cloudflare for CDN, DDoS protection, and Web Application Firewall (WAF)

PHP

Luma doesn’t use PHP anywhere: not in our website, API, or infrastructure. Vulnerabilities in PHP, or in PHP software like WordPress, Laravel, or Drupal, don’t affect Luma.

How We Handle New Vulnerabilities

When a vulnerability affects something we do use, we patch it promptly:

Automated dependency scanning flags vulnerable packages
Security patches are applied on a priority basis, starting with anything exposed to the internet
Cloudflare’s WAF often blocks known exploit attempts before a patch is even needed

We don’t send a notice for every vulnerability announced publicly. If a security incident affects your data, we’ll notify you consistent with our legal obligations.

Reporting a Vulnerability

If you’ve found a vulnerability in Luma itself, see our Security & Bug Bounty Program for how to report it.