magento2-security-scan

# Magento 2 Security Scanner This skill performs security scanning for vulnerabilities, misconfigurations, and compliance issues. ## Related Skills **REQUIRED BACKGROUND:** Load `magento2-dev-core` first — this skill scans for violations of the security patterns it defines (escaping, discouraged functions, ObjectManager misuse), and its patterns are what you fix findings with. Part of the QA trio with `magento2-linter` (style/static analysis) and `magento2-performance-audit` (runtime/infrastructure). Re-check API/resolver-specific findings against `magento2-backend-dev`. ## Vulnerability Categories ### 1. Injection Vulnerabilities | Type | Pattern | Severity | Code | |------|---------|----------|------| | SQL Injection | Direct SQL with user input | Critical | M2-SEC-001 | | XSS (Reflected) | Unescaped user input in output | High | M2-SEC-003 | | XSS (Stored) | Unescaped database content | Critical | M2-SEC-002 | | Command Injection | System command execution with user input | Critical | M2-SEC-004 | Full scale and code catalogue: `magento2-dev-core/references/severity-and-codes.md`. ### 2. Authentication & Authorization | Check | Command | |-------|---------| | Admin path changed | Check env.php for custom admin path | | 2FA enabled | Check admin/twofactor module | | Password hashing | Verify EncryptorInterface usage | | Session security | Check cookie configuration | ### 3. Data Exposure ```bash # Check for exposed sensitive files curl -I https://store.test/app/...