This app never sends a private key anywhere — every on-chain action is signed inside the user's own wallet (see the security page for the full flow). If you find a case where that isn't true, or another vulnerability, please report it privately through the StellarTickets GitHub organization rather than opening a public issue.