The Security Baseline for Magento 2

139 Magebean rules across 12 controls. PCI DSS and OWASP ASVS clauses are outside this baseline; use their official documents for those requirements.

MB-C01 — File & Folder Permissions

MB-0001 No world-writable files or directories No world-writable files or directories; assess only the collected Magento deployment scope. High Automated
MB-0002 env.php satisfies configured mode and ownership policy The collected app/etc/env.php Unix permission bits are a subset of configured mode 0640, and its owner and group match the configured reference paths (the project root by default). This is an explicit deployment ownership policy, not proof of effective ACL or web-process access restrictions. High Automated
MB-0003 Webroot hygiene (no .git/.env/backups in pub/) Webroot hygiene (no .git/.env/backups in pub/); assess only the collected Magento deployment scope. High Automated
MB-0004 Code directories are read-only Code directories are read-only for the application runtime in the collected Magento deployment; assess effective runtime identity, permissions, ACLs and read-only mounts. High Partial
MB-0005 Directory listing absent on probed Magento paths Successful responses from the configured runtime endpoint on /media/, /static/, /errors/ and /var/ must not expose recognizable directory-index markup. Scope is these paths at scan time; transport or unsupported responses are inconclusive. Medium Automated
MB-0083 No cardholder data in files, exports, or backups Verify actual in-scope files, exports, logs and backups do not retain prohibited cardholder or sensitive authentication data. Static PAN-like and sensitive-field pattern observations are supporting evidence only; missing matches, unreadable files or uncollected backup formats cannot establish absence of such data. Critical Partially automated
MB-0748 No executable code in media or upload paths No executable code in media or upload paths; assess only the collected Magento deployment scope. Critical Partially automated
MB-0780 Media inventory has no executable PHP-like filenames The bounded readable pub/media filename inventory contains no PHP-like executable extension, including double extensions. Symlinks, unreadable subtrees and budget gaps remain unresolved. Web-server execution policy is separate evidence. High Automated
MB-0781 Named sensitive HTTP paths are denied or absent Six named deployment artifact paths are denied or absent over HTTP. A bounded prefix containing a recognizable artifact signature is a violation; ambiguous 200 pages, redirects and transport gaps remain unresolved. No response contents are retained. High Automated
MB-0782 Sensitive deployment configuration excluded from Git index The readable current deployment Git index does not track app/etc/env.php. Historical commits, remote repositories and deployments without a readable Git index require separate evidence. High Automated
MB-0799 Application worker code paths are read-only For every explicitly supplied PHP-FPM worker PID, the scanner and worker have identical effective UID/GID/groups, zero effective/permitted/ambient capabilities, matching project tree, mount namespace and Linux security context. Kernel access observations find no writable object or replaceable code root in the complete bounded configured app/vendor/lib inventory. Unsupported identity, seccomp, links or inventory gaps remain UNKNOWN. Medium Automated
MB-0800 Upload inventory has no configured PHP or handler signatures Within the complete bounded configured upload path inventory, readable files contain no explicit long PHP opening tags or configured htaccess script-handler signatures and no PHP-like executable filename extension. Missing/unreadable/oversized eligible files, unfollowed links and traversal-budget gaps remain UNKNOWN. This is a signature policy, not absence of arbitrary executable content or prevention of server execution. Medium Automated

MB-C02 — Admin & Auth Hardening

MB-C03 — Secure Coding Practices

MB-C04 — HTTPS & TLS Enforcement

MB-C05 — Production Mode & Deployment Hygiene

MB-C06 — Cache & Indexing Health

MB-C07 — Logging & Monitoring

MB-C08 — Cron Job Reliability

MB-C09 — Extension Vulnerability Management

MB-C10 — Abandoned Extensions Removal

MB-C11 — Composer Dependency Hygiene

MB-C12 — Third-party Config Security

The Security Baseline for Magento 2

139 Magebean rules across 12 controls. PCI DSS and OWASP ASVS clauses are outside this baseline; use their official documents for those requirements. Filter by catalog coverage and severity. Coverage describes implementation capability, not a scan result.

Catalog coverage

Severity