Security

How LumiList protects your data and infrastructure.

🔒 Encryption

All traffic between your browser and LumiList is encrypted with TLS 1.3. Data at rest is encrypted at the database level. Passwords are hashed using bcrypt with a work factor of 12 — we never store plaintext credentials.

🛡 Authentication

Session management uses HTTP-only, Secure, SameSite cookies with server-side CSRF protection for every state-changing request. Session tokens are rotated on login and logout to prevent fixation attacks.

💳 Payment Security

All payment processing is handled by Paddle, a PCI Level 1 certified payment processor. LumiList never sees, stores, or transmits your credit card details. Paddle handles all sensitive payment data in their PCI-compliant environment.

🛰 Infrastructure

LumiList is hosted on Railway with isolated containers per deployment. Cloudflare provides CDN, DDoS protection, and Web Application Firewall (WAF) filtering. Rate limiting is enforced on all API endpoints to prevent abuse.

🔍 Third-Party Audits

LumiList is fully open source. Anyone can audit the code for security vulnerabilities. We welcome community code reviews and security research.

Responsible Disclosure

If you discover a security vulnerability in LumiList, we encourage responsible disclosure:

We will acknowledge receipt within 24 hours and keep you informed of the fix timeline. We do not currently operate a formal bug bounty program but will gladly acknowledge contributors.

Security Checklist