Skip to content
    ← Back to home

    Company

    Security

    How WavePhase protects accounts and builds, what Cloud stores at a high level, and how to report a vulnerability. This page does not publish exploit detail.

    Accounts and sessions

    Sign-in uses a magic link and a six-digit code. Sessions use HttpOnly cookies. Login, account, dashboard and private build pages are not for search indexing.

    Builds

    Installer access is authorised on the server. Page source does not publish permanent public object URLs. Where a SHA-256 checksum is stored for a build, it is shown after you sign in.

    Cloud (high level)

    Optional Cloud stores versioned packaged shows (graph, fixtures, layout and media the show needs) and can relay Web Control over the internet with password, roles and link rotation. Local .wphase files still run fully offline. See Cloud docs.

    What is not a security boundary

    Show Lock is an operator PIN for unattended kiosks, not a substitute for OS access control. A lighting LAN is a show network: treat Art-Net/sACN as untrusted on shared office Wi-Fi. Desktop software that outputs DMX can affect physical systems — you remain responsible for testing the rig.

    Report a vulnerability

    Email [email protected] with a clear description. Do not send exploit-enabling detail to public Discord channels.