---
title: "Security Vulnerability FAQ"
subtitle: "Whether Luma is affected by publicly announced security vulnerabilities"
slug: "vulnerabilities"
url: "https://help.luma.com/p/vulnerabilities"
tags: ["Security", "FAQ"]
---

When a major vulnerability is announced in a widely used language, framework, or library, we often get asked whether Luma is affected. This page answers those questions. For an overview of our security program, see [Enterprise Security](/p/enterprise-security).

## What Luma Is Built With

Here’s an overview of the main parts of our stack.

- **Backend**: TypeScript running on [Bun](https://bun.sh), deployed on AWS
- **Website**: TypeScript and React with [Next.js](https://nextjs.org)
- **Database**: PostgreSQL
- **Mobile apps**: Swift on iOS and Kotlin on Android
- **Edge**: Cloudflare for CDN, DDoS protection, and Web Application Firewall (WAF)

## PHP

Luma doesn’t use PHP anywhere: not in our website, API, or infrastructure. Vulnerabilities in PHP, or in PHP software like WordPress, Laravel, or Drupal, don’t affect Luma.

## How We Handle New Vulnerabilities

When a vulnerability affects something we do use, we patch it promptly:

- Automated dependency scanning flags vulnerable packages
- Security patches are applied on a priority basis, starting with anything exposed to the internet
- Cloudflare’s WAF often blocks known exploit attempts before a patch is even needed

We don’t send a notice for every vulnerability announced publicly. If a security incident affects your data, we’ll notify you consistent with our legal obligations.

## Reporting a Vulnerability

If you’ve found a vulnerability in Luma itself, see our [Security & Bug Bounty Program](/p/security-bug-bounty) for how to report it.