Found a security issue?
Tell us. Organisers trust us with their takings and their buyers trust us with their payments, so we look into every report we get.
Email security@eventtickets.devWhat to send us.
A short email is fine. We'll confirm we've got it, keep you posted while we fix it, and let you know when it's done.
- What you found and where, with the page or address affected
- Steps we can follow to see it for ourselves
- What someone could do with it, if you know
What we ask of you.
- Only access what you need to show the issue, and never other people's orders or details
- Don't disrupt live events, so no load testing or anything that slows checkout or the door
- Don't try to trick our team, organisers or buyers
- Give us a fair chance to fix it before you tell anyone else
If you report in good faith and follow these, we'll work with you, not against you.
Not covered.
- Organisers' own websites
- Reports from automated scanners without a working example
- Denial of service or flooding
- Missing headers or settings that can't be used to cause harm
Bought a ticket and something looks wrong? Contact the organiser using the email on your ticket.
How we look after you.
- Card numbers never reach us.
- Payments are taken by Stripe, so buyers' card details go straight to them.
- Only the people you invite.
- Your dashboard is open to your team and no one else, and door links stop working when you say.
- Watched around the clock.
- Checkout, the door app and the API are monitored day and night, with a public status page.
Put your next event on sale.
Create an account, add your event and share the checkout link. No card needed, and you only pay when you sell.