Security
1. Reporting a Vulnerability
Do not file a public issue, GitHub ticket, or social-media post.
Public disclosure before a fix is available puts every MageRa customer at risk. Email security@magera.ca with a clear description, reproduction steps, the affected extension name and version, and your contact info. PGP key available on request.
Our Response Targets
| Severity (CVSS v3.1) | Acknowledge | Triage | Fix Window |
|---|---|---|---|
| Critical 9.0 – 10.0 | 1 business day | 3 business days | 7 days |
| High 7.0 – 8.9 | 1 business day | 5 business days | 30 days |
| Medium 4.0 – 6.9 | 2 business days | 10 business days | 90 days |
| Low 0.1 – 3.9 | 5 business days | 20 business days | Next release |
2. Safe Harbor
When conducting vulnerability research in good faith and in accordance with this policy, MageRa considers the research authorized and will not initiate legal action. We will work with you to understand and resolve the issue, including issuing a CVE and public credit.
3. Secure Development Lifecycle
Threat modelling for any feature touching auth, payments, PII, or admin actions.
Mandatory second-engineer review. Must explicitly check OWASP Top 10.
PHP_CodeSniffer, PHPMD, PHPStan level 8+ on every build.
composer audit on every build. Fails on any high/critical CVE.
Unit + integration tests covering auth, input validation, output escaping.
SHA-256 checksums and signed manifest. Signature verified on install.
4. Magento-Specific Security Checklist
Every extension is reviewed against these risks before release:
| Risk | Control |
|---|---|
| SQL Injection | Resource-model collections; named binding via ->select(); no string concatenation into SQL. |
| XSS | ->escapeHtml() / escapeUrl / escapeJs on all user-supplied output. |
| CSRF | Form-key validation on all state-changing endpoints. |
| RCE | No eval(), assert(), create_function(); no unsafe deserialization. |
| Authorization | Every admin controller declares ADMIN_RESOURCE; webapi routes use minimal ACL scope. |
| Path Traversal | Allow-listed path components; user input never passed to filesystem functions. |
| Open Redirects | All redirect targets use getUrl() with validated input. |
| Info Disclosure | No debug output in production; display_errors off. |
5. Runtime & Infrastructure
TLS 1.2+ everywhere; HSTS with preload.
AES-256 for databases, storage, and backup volumes.
Least-privilege IAM; MFA required; short-lived credentials via SSO.
WAF; rate limiting on auth and download endpoints; default-deny egress.
Central tamper-evident audit log; anomaly detection; 24/7 on-call.
Encrypted, regularly tested, documented RTO/RPO.
6. Compliance
- GDPR & UK GDPR — see DPA and Privacy Policy
- SOC 2 Type II — annual audit; executive summary under NDA
- ISO 27001:2022 — certified ISMS
- PIPEDA — see Privacy Policy
7. Security Advisories & CVEs
- Advisories published at magera.ca/blog?tag=security-advisory with CVE where applicable.
- Customers with active support notified by email 24 hours before publication.
- Patched versions pushed to the Composer repository with a clear version bump.
8. Update & Patching Policy
Critical and high-severity issues receive out-of-band patches; medium and low are bundled into the next regular release. End-of-life extensions get security-only releases for 12 months after the last feature release.
9. Customer Recommendations
- Subscribe to
security-advisoryon our blog. - Verify every MageRa package against the SHA-256 checksum before deploying.
- Keep Magento 2, PHP, and MageRa extensions on supported versions (PHP 8.3+).
- Run
composer auditweekly in CI and after every production update. - Enable admin 2FA and restrict admin paths to known IPs.
- Review admin actions via the MageRa Admin Action Log extension.
10. Acknowledgments
Thanks to the security researchers, customers, and community members who have helped us make MageRa safer. We are happy to credit researchers (with their permission) in published advisories.