security

Adds a Change Password tab to the customer edit page in admin so support can reset a customer's password with re-auth confirmation. Includes composer install, enablement, and configuration steps.

Caps recently viewed items at 10 on client and server. Trims localStorage and truncates sync requests to prevent bloated storage, huge POSTs, and database hammering, mitigating a simple DoS vector.

Signature-based scanner and file integrity monitor with quarantine, an admin findings grid, scheduled scans, and email alerts. Includes request-time guards for uploads, REST, and GraphQL to block webshells, polyglots, and other payloads before they reach disk.

CLI that polls KEV, NVD, GHSA, OSV, and Packagist, filters results against your composer.lock, and scores with CVSS/EPSS/KEV. Sends only P0/P1 alerts to Slack and returns exit codes for CI gating.

Magento is an attractive target for payment skimmers and the number of attacks has increased steadily since 2015. In 2018, attackers shifted from Magento core exploits (eg, Shoplift, brute force attacks on admin passwords) to 3rd party software components. This poses a practical problem: there is no central place where one can (programmatically) find out whether a particular module version has known security issues. This repository solves that!