On this page
What a profile does
A system Profile is a Magebean-provided security template. It organizes Rules for a purpose, but it does not establish Company scope and does not turn every Rule into automated verification. Configure the Profile into a Company-controlled Baseline, then assign that required Baseline to Applications—not directly to individual Instances.
Built-in CLI profiles
| Profile | Default selection | Use |
|---|---|---|
| basic | 21 rules | Fast, low-noise production security and operations check. |
| asvs-l1 | 32; 60 with manual | OWASP ASVS Level 1 evidence-oriented mapping. |
| asvs-l2 | 73; 183 with manual | Cumulative Level 2 mapping with contextual rules. |
| asvs-l3 | 80; 259 with manual | Cumulative Level 3 mapping requiring substantial human assurance. |
| owasp | 77 rules | Application-security checks mapped to OWASP Top 10 2025. |
| pci | 67; 68 with manual | PCI DSS 4.0.1 supporting-evidence readiness; not certification. |
| hardening | 91; 92 with manual | Deep production, dependency, code, integration, and operations checks. |
| baseline | 113; 371 with manual | The complete local Magebean catalog. |
Counts describe the current CLI version and can change as mappings and rules evolve. Confirm current values in the CLI profile reference.
Choose by assessment purpose
- Routine first scan: begin with
basic. - Production hardening: use
hardeningwhen deeper operational review is appropriate. - Complete Magebean baseline: use
baselineand include human-required rules for full catalog visibility. - Standards-oriented work: select the relevant ASVS or PCI profile, confirm formal scope separately, and retain human evidence.
php magebean.phar rules:list --profile=basic
php magebean.phar scan --path=/var/www/magento --profile=hardeningInclude human-required and contextual rules deliberately
Use --include-manual-review when the assessment must expose rules that cannot be completed automatically. For capability-dependent ASVS rules, declare only capabilities that are actually present.
php magebean.phar scan \
--path=/var/www/magento \
--profile=asvs-l2 \
--include-manual-review \
--capabilities=graphql,oauth_oidcA false or unspecified capability does not activate the related contextual rules. Document the capability decision as part of assessment scope.
Use custom profiles for approved organization policy
A custom CLI profile contains an ID and selected Rule IDs for local execution policy. It is distinct from the Dashboard’s system Profile and Company Baseline entities. Store it in source control, review changes, and avoid using exclusions merely to make a pipeline pass.
See the custom profile schema →Configure the Baseline and preserve Assessment snapshots
Record the source Profile, selected Rules, verification expectations, applicability decisions, Assessment frequency, and material exclusions. Required Baseline assignment to an Application is manual in the MVP.
Creating an Assessment snapshots the Baseline configuration. Later Baseline changes do not modify existing Assessments. Baseline version history and automatic migration after changes are not available in the MVP.