security
-
https://github.com/TonyMerlin/M2-AdminFileManager
Adds an admin-area file browser and text editor with clickable breadcrumbs, ACL-controlled view/edit access, and a detailed activity log. Enforces strict security with path validation, a sensitive-file denylist, and allowlisted text types only—no upload, delete, or rename actions.
11 -
https://www.samdjames.uk/blog/magento-ai-operational-maturity/
A priority-ordered roadmap for using AI at speed without chaos: automated deployments, ephemeral environments, E2E and unit tests, static analysis, and security tooling. Explains what “good” looks like, what breaks without each layer, and where to start.
-
https://github.com/Space48/magento2-sso
Adds SAML-based single sign-on for backend users, compatible with IdPs like Auth0, OneLogin, and Amazon SSO. Install via composer and configure under Stores > Configuration > Advanced > Admin > Single Sign-on.
719 -
https://mageinfo.online/
Instantly checks if your shop is up to date, flags known CVEs, and reviews server configuration, including full DNS analysis.
-
https://github.com/yellowteak/magento2-change-customer-password
Adds a Change Password tab to the customer edit page in admin so support can reset a customer's password with re-auth confirmation. Includes composer install, enablement, and configuration steps.
26 -
https://github.com/graycoreio/github-actions-magento2
Prebuilt CI pipelines (MageCheck Extension/Store) plus individual actions for setup, caching, version detection, coding standards, DI compile, and Sansec eComscan. Plug them into your repo to run quality checks and installs on GitHub with minimal configuration.
1772 -
https://github.com/Vendic/magento2-recently-viewed-limit
Caps recently viewed items at 10 on client and server. Trims localStorage and truncates sync requests to prevent bloated storage, huge POSTs, and database hammering, mitigating a simple DoS vector.
12 -
https://github.com/DeployEcommerce/module-prevent-order-placement
Adds an admin-managed ruleset that blocks checkout when billing or shipping data matches configured fragments (street, city, county, postcode, phone), using case-insensitive substring and digit-only phone matching. Includes an audit log of blocked attempts, a per-store kill switch, and an inline rule-impact preview based on recent orders and quotes.
13 -
https://github.com/mage2sk/module-malware-scanner
Signature-based scanner and file integrity monitor with quarantine, an admin findings grid, scheduled scans, and email alerts. Includes request-time guards for uploads, REST, and GraphQL to block webshells, polyglots, and other payloads before they reach disk.
26 -
https://www.samdjames.uk/blog/copy-fail-cve-2026-31431/
Explains the AF_ALG kernel bug that allows any local user to escalate to root. Provides an emergency mitigation (disable algif_aead with an Ansible snippet) and advises updating to patched kernels.