We take the security of Cuelight seriously. If you believe you've found a vulnerability that affects our service or our customers' data, we want to hear from you. This page documents how to report, what to expect, and the boundaries of our scope.
Reporting a vulnerability
Email your report to security@cuelight.com. Please include:
- A description of the issue, including the affected URL or feature and the type of vulnerability (e.g. IDOR, SSRF, XSS, auth bypass).
- Reproduction steps detailed enough for our team to recreate the issue from a clean account.
- Proof-of-concept artifacts (request/response captures, scripts, screenshots, videos) when they help clarify impact.
- Your assessment of the impact: what an attacker could do with the bug and which data is at risk.
If your report includes sensitive material you'd prefer to send encrypted, mention that in your initial email and we'll arrange a secure transfer.
What you can expect from us
- Acknowledgement within 3 business days of your initial report.
- Triage update with our preliminary severity assessment within 7 business days.
- Resolution timeline communicated once triage completes. Typical targets are 14 days for high-severity, 30 days for medium, 90 days for low.
- Credit in our release notes if you'd like public acknowledgement (entirely your choice).
Safe harbor
We will not pursue legal action against researchers who act in good faith, follow the scope and conduct guidelines on this page, and give us a reasonable opportunity to fix the issue before public disclosure. Specifically, your testing is welcome so long as you:
- Only test against accounts you own or have explicit written permission to test.
- Avoid accessing, modifying, or destroying data that doesn't belong to your own test account.
- Don't run denial-of-service attacks, send mass volumes of traffic, or degrade service for other users.
- Don't use social engineering, phishing, or physical attacks against our staff, vendors, or facilities.
- Give us a reasonable window to remediate before disclosing publicly. Typically 90 days, less for issues already actively exploited.
In scope
- cuelight.com and all subdomains we operate.
- Our public APIs and the buyer, agency, artist manager, and tour manager portals.
- The Lightix ticketing surfaces at lightix.live.
- Authentication, authorization, multi-tenant isolation, and billing.
- Any handling of PII, financial data, or contractual documents.
Out of scope
- Findings from automated scanners with no demonstrated impact (e.g. missing security headers without a working exploit chain).
- Self-XSS, clickjacking on pages with no sensitive actions, and CSRF on logout.
- Vulnerabilities in third-party services we use (Clerk, Stripe, Vercel, Neon, Resend, etc.). Please report those to the vendor directly.
- Best-practice suggestions that aren't exploitable vulnerabilities.
- Issues that require physical access to a user's device or session.
security.txt
We publish a machine-readable contact at /.well-known/security.txt per RFC 9116, so security tooling can discover this address automatically.
Thanks for helping keep Cuelight and our customers safe.