From b20faf5e5b3c05e126f5c5756fe81ecaa900c33b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 29 Jul 2026 12:34:50 +0000
Subject: [PATCH 1/2] Initial plan


From 225b017f5c165ba6808e8d0ca65a32c3d31d5d66 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 29 Jul 2026 12:39:28 +0000
Subject: [PATCH 2/2] docs: expand general security guidance page

---
 resources/references/security.md | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/resources/references/security.md b/resources/references/security.md
index 75a90b608c..8285ce638a 100644
--- a/resources/references/security.md
+++ b/resources/references/security.md
@@ -11,6 +11,26 @@ nav:
 
 This reference presents a comprehensive compilation of all security measures implemented in Shopware 6, along with instructions on how to configure them.
 
+## Security updates
+
+Keeping your installation on the latest patch version is the primary way to close known vulnerabilities in Shopware and its shipped dependencies.
+
+If you cannot upgrade immediately, install and keep the [Security Plugin](../../guides/hosting/installation-updates/security-plugin.md) up to date as a temporary mitigation layer until you can complete the Shopware update.
+
+## Published vulnerabilities
+
+Shopware publishes all security advisories on GitHub. Use the table below as your central entry point for vulnerability tracking:
+
+| Scope | Description | Link |
+|-------|-------------|------|
+| Published Shopware vulnerabilities | Complete list of published Shopware advisories, including affected version ranges, severity, and mitigation details | [Shopware security advisories (published)](https://github.com/shopware/shopware/security/advisories?state=published) |
+
+## Basic hardening checklist
+
+- Use strong, unique passwords for Administration users, database users, and all infrastructure accounts.
+- Set `APP_ENV=prod` in production environments. Do not run publicly reachable production systems with `APP_ENV=dev`.
+- Keep staging or preview environments private. Protect them with authentication, IP allowlists, or VPN access and do not expose them publicly on the internet.
+
 :::info
 If you have found a security vulnerability in Shopware, please report it to us following the instructions in our [Security Advisory Form](https://github.com/shopware/shopware/security/advisories/new).
 :::
@@ -74,7 +94,7 @@ SameSite prevents the browser from sending cookies along with cross-site request
 
 ## Security plugin
 
-Obtaining security fixes without version upgrades is possible through the [Security plugin](../../guides/hosting/installation-updates/cluster-setup.md#security-plugin).
+Obtaining security fixes without version upgrades is possible through the [Security plugin](../../guides/hosting/installation-updates/security-plugin.md).
 
 ## Storefront IP Whitelisting