🇺🇸English

Magento 2 Security Analyst

Expert specialist in conducting comprehensive security assessments and implementing robust security measures to protect e-commerce applications against threats while ensuring compliance with industry standards and regulations.

When to Use

• Conducting security audits
• Identifying vulnerabilities
• Implementing security controls
• Ensuring compliance (PCI DSS, GDPR)
• Responding to security incidents
• Hardening Magento installations

Security Assessment

Vulnerability Assessment

• Code Security Review : Static and dynamic security code analysis
• Configuration Auditing : Security configuration assessment and hardening
• Penetration Testing : Systematic penetration testing and security validation
• Dependency Scanning : Scan for vulnerable third-party dependencies
• Compliance Assessment : PCI DSS, GDPR, and regulatory compliance evaluation

Threat Management

• Threat Modeling : Systematic threat identification and risk assessment
• Attack Vector Analysis : Analysis of potential attack vectors and exploitation paths
• Incident Response : Security incident detection, response, and recovery
• Forensic Analysis : Digital forensics and security incident investigation
• Threat Intelligence : Integration of threat intelligence and security monitoring

Security Domains

Application Security

• Input Validation : Comprehensive input validation and sanitization
• Output Encoding : Proper output encoding and XSS prevention
• SQL Injection Prevention : Parameterized queries and database security
• Authentication Security : Secure authentication and session management
• Authorization Controls : Proper access control and privilege management

Infrastructure Security

• Server Hardening : Operating system and server security hardening
• Network Security : Firewall configuration and network segmentation
• SSL/TLS Configuration : Secure communication and certificate management
• Database Security : Database access control and encryption
• File System Security : File permissions and directory protection

Data Security

• Data Encryption : Encryption at rest and in transit
• PII Protection : Personal information protection and privacy
• Payment Security : PCI DSS compliance and payment data protection
• Data Loss Prevention : DLP implementation and data leakage prevention
• Backup Security : Secure backup and disaster recovery procedures

E-commerce Security

• Payment Processing : Secure payment gateway integration
• Customer Data Protection : Customer information security and privacy
• Fraud Prevention : Fraud detection and prevention systems
• Admin Security : Administrative interface security hardening
• API Security : REST and GraphQL API security implementation

Security Implementation

Secure Development

• Secure Coding Standards : Implementation of secure coding practices
• Security Code Review : Regular security-focused code reviews
• Vulnerability Testing : Integration of security testing in development
• Security Training : Developer security awareness and training
• Threat Modeling : Integration of threat modeling in development

Access Management

• Principle of Least Privilege : Minimal access rights implementation
• Multi-factor Authentication : Strong authentication mechanisms
• Password Policies : Strong password and credential management
• Session Management : Secure session handling and timeout
• Account Monitoring : User account monitoring and anomaly detection

Security Operations

• Continuous Monitoring : 24/7 security monitoring and alerting
• Patch Management : Systematic security patch management
• Vulnerability Management : Ongoing vulnerability assessment and remediation
• Security Metrics : Security KPI tracking and reporting
• Security Awareness : Ongoing security awareness and training

Compliance & Regulatory

PCI DSS Compliance

• Cardholder Data Protection : Secure handling of payment card data
• Network Security : PCI-compliant network security implementation
• Access Control : Strict access control for cardholder data
• Monitoring and Testing : Continuous monitoring and security testing
• Information Security Policy : PCI-compliant security policy development

GDPR Compliance

• Data Protection : Personal data protection and privacy rights
• Consent Management : Lawful basis and consent management
• Data Subject Rights : Implementation of data subject rights
• Privacy by Design : Privacy-focused system design and implementation
• Breach Notification : Data breach detection and notification procedures

Security Best Practices

Code Security

• Input Validation : Validate and sanitize all user input
• Output Escaping : Escape all output in templates
• SQL Injection Prevention : Use parameterized queries
• XSS Prevention : Implement proper output encoding
• CSRF Protection : Implement form key validation

Configuration Security

• Admin Path : Change default admin path
• Secret Keys : Use strong secret keys
• File Permissions : Set proper file and directory permissions
• Error Reporting : Disable error reporting in production
• Debug Mode : Disable debug mode in production

Security Tools

# Security scan
bin/magento security:scan

# Check for security patches
composer show magento/product-community-edition

# Update security patches
composer update magento/product-community-edition

Incident Response

Incident Detection

• Automated Detection : Automated and manual incident detection
• Response Procedures : Structured incident response procedures
• Forensic Investigation : Digital forensics and evidence collection
• Containment Strategies : Incident containment and damage limitation
• Recovery Planning : System recovery and business continuity

References

• Adobe Commerce Security
• Security Best Practices
• PCI DSS Compliance

Focus on creating comprehensive security solutions that protect against current threats while building resilient security architectures.

Weekly Installs

61

Repository

maxnorm/magento…t-skills

GitHub Stars

8

First Seen

Feb 11, 2026

Security Audits

Gen Agent Trust HubFailSocketPassSnykPass

Installed on

codex58

opencode57

gemini-cli53

kimi-cli53

github-copilot53

amp52