Security

How Luria keeps your site safe, what it can and cannot touch, how changes are reversed, and where to report a vulnerability.

Short version: Luria can change words and styling on your pages, and it can only do that while its script is loaded. It cannot take payments, read card data, or edit your theme code. Everything below expands on that.

The snippet

Loads only from https://luriart.com, over HTTPS. There is no self-hosted or CDN-mirrored copy, so every site always runs the current, patched version.
Small and asynchronous. It never blocks your page from rendering.
Fails open. Any error, blocked request, or bad response, and your page behaves exactly as if Luria were not installed.
Scoped. It can change the text and inline styles of specific elements. It refuses to touch html, head, body, or the whole document, and it caps how many elements one change can affect, so a change can never blank a page.

On Shopify

Luria never edits your theme code. It runs as an app embed you switch on in the theme editor.
Purchases are read through Shopify's pixel and order webhook, not by scraping your checkout.
The store access token Shopify grants is held server-side, encrypted at rest, and is never shown in a browser.
Shopify's mandatory privacy webhooks (customer data request, customer redact, shop redact) are supported, so customer deletion requests you receive in Shopify flow through to Luria automatically.

Changes are validated and reversible

Every change Luria proposes is checked against your Brand Brain and do-not-say rules before it can go live. See Brand Brain.
You can require approval before anything ships. See Approvals.
Every live change is logged with what changed and when, and can be rolled back.
Kill switch: pausing Luria in the dashboard, switching the embed off, or removing the tag stops all changes within about 60 seconds.

Payment data

No card data ever touches Luria. Your visitors' payments go through your platform's checkout (Shopify Payments, Stripe, and so on). Your own Luria subscription is billed by a payment processor; Luria stores no full card numbers. See Billing.

Access and accounts

Sign-in is by magic link to your email; there is no Luria password to leak.
You control who is on your account. See Team access.
Luria staff access customer accounts only for support, on request, and access is logged.

Certifications

Luria does not hold a SOC 2 report or ISO 27001 certification yet. We run on Supabase and Vercel, which publish their own compliance documentation, and we will share our security practices and sub-processor list on request. If your procurement team needs a security questionnaire completed, email support@luriart.com.

Responsible disclosure

If you find a vulnerability in Luria, email security@luriart.com. Please include steps to reproduce. We acknowledge reports within two business days and will not pursue action against good-faith researchers who avoid accessing other customers' data.