# Security
Source: https://docs.luriart.com/privacy/security
Plain text: https://docs.luriart.com/privacy/security.txt

The guardrails in the snippet, the headers and encryption behind Luria, the abuse controls, and what Luria does not claim.

The short version: Luria can change words and inline styling on specific elements of your pages, and only while its script is running. It cannot take payments, read card data, or edit your theme code.

## What you'll need
Nothing. This page is a reference.

## What the snippet can and cannot do
* Text and inline style, on named elements. That is the entire set of operations.
* It refuses any selector that would reach `html`, `head`, `body`, `*` or `:root`, and it skips a change that would hit more than five elements. A change cannot blank your page.
* It fails open. Any error, blocked request or bad response, and your page behaves exactly as if Luria were not installed.
* It loads asynchronously, and the anti-flicker hide is capped at 250 ms with a hard timeout that always reveals the page.
* It never edits your theme code. On Shopify, serving is the app embed: switch the embed off and Luria loads nothing.
* Kill switch: a paused site gets no changes, within about 60 seconds.

## In transit and at rest
* HTTPS everywhere. HSTS is set for two years, includes subdomains, and is preload-ready.
* Shopify access and refresh tokens are encrypted with AES-256-GCM before they are stored. They are never rendered in a browser and never included in a data export.
* Visitor data is partitioned per site in the database.

## Headers
Every Luria page carries a Content-Security-Policy, `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, a strict-origin-when-cross-origin referrer policy, a Permissions-Policy that switches off camera, microphone, geolocation, payment and USB, `Cross-Origin-Opener-Policy: same-origin`, and DNS prefetching off.

The one exception is the Luria app page inside Shopify admin, which is allowed to be framed by admin.shopify.com and your store admin, and by nothing else.

## Abuse controls
* Every endpoint has a per-IP rate limit. Visitor telemetry and variant delivery are high but finite; the export endpoint allows five requests an hour and the delete endpoint three.
* Public forms sit behind a Cloudflare Turnstile check.
* The onboarding scanner only accepts public http and https hosts. A URL that resolves to a private, loopback or cloud-metadata address is refused, so Luria cannot be pointed at an internal network.

## What Luria does not claim
Luria has no SOC 2 report, no ISO certification, no published penetration test, and no uptime commitment. If a vendor questionnaire asks, the honest answer is that none of those exist yet. When they do, they will appear on this page.

## Reporting a problem
Email [hello@luriart.com](mailto:hello@luriart.com) with what you found and how to reproduce it. There is no separate security address and no bug bounty.

## Verify it worked
* Search your published theme files for "luria". On Shopify you should find nothing: Luria lives in the app embed, not in your code.
* Switch the app embed off and Save. Within about a minute, your storefront should stop requesting anything from luriart.com.

## Common failures
* **Your site's own CSP blocks Luria.** If you set a Content-Security-Policy, `luriart.com` has to be allowed in `script-src` and `connect-src`, or the snippet cannot load or report. See [Snippet not firing](/troubleshooting/snippet-not-firing).
* **An ad blocker blocks it.** Blocked requests are fail-open, so the page still renders normally, but that browser produces no data.
* **You need a completed security questionnaire.** There is no standard package to send. Email [hello@luriart.com](mailto:hello@luriart.com) with the questions.

## Next steps
  - [What Luria stores](/privacy/what-is-stored)
  - [Deletion and the DPA](/privacy/deletion-and-dpa)
  - [Snippet not firing](/troubleshooting/snippet-not-firing)
  - [Uninstall Luria](/reference/uninstall)