Skip to content

Add dedicated general security guidance to Shopware security reference #2409

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Copilot wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

Add dedicated general security guidance to Shopware security reference #2409

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b20faf5
Initial plan
Copilot Jul 29, 2026
225b017
docs: expand general security guidance page
Copilot Jul 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 21 additions & 1 deletion resources/references/security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,26 @@ nav:

This reference presents a comprehensive compilation of all security measures implemented in Shopware 6, along with instructions on how to configure them.

## Security updates

Keeping your installation on the latest patch version is the primary way to close known vulnerabilities in Shopware and its shipped dependencies.

If you cannot upgrade immediately, install and keep the [Security Plugin](../../guides/hosting/installation-updates/security-plugin.md) up to date as a temporary mitigation layer until you can complete the Shopware update.

## Published vulnerabilities

Shopware publishes all security advisories on GitHub. Use the table below as your central entry point for vulnerability tracking:

| Scope | Description | Link |
|-------|-------------|------|
| Published Shopware vulnerabilities | Complete list of published Shopware advisories, including affected version ranges, severity, and mitigation details | [Shopware security advisories (published)](https://github.com/shopware/shopware/security/advisories?state=published) |

## Basic hardening checklist

- Use strong, unique passwords for Administration users, database users, and all infrastructure accounts.
- Set `APP_ENV=prod` in production environments. Do not run publicly reachable production systems with `APP_ENV=dev`.
- Keep staging or preview environments private. Protect them with authentication, IP allowlists, or VPN access and do not expose them publicly on the internet.

:::info
If you have found a security vulnerability in Shopware, please report it to us following the instructions in our [Security Advisory Form](https://github.com/shopware/shopware/security/advisories/new).
:::
Expand Down Expand Up @@ -74,7 +94,7 @@ SameSite prevents the browser from sending cookies along with cross-site request

## Security plugin

Obtaining security fixes without version upgrades is possible through the [Security plugin](../../guides/hosting/installation-updates/cluster-setup.md#security-plugin).
Obtaining security fixes without version upgrades is possible through the [Security plugin](../../guides/hosting/installation-updates/security-plugin.md).

## Storefront IP Whitelisting

Expand Down