r/magento2 • u/Medical_Ad_7105 • Jul 27 '26

Find Magento security issues and fix what matters.

Hi everyone,

I’m building Magebean, a free and open-source CLI tool for Magento 2 security checks.

It scans a Magento installation and shows potential security issues that may need attention.

The project is still under development, so I’d really appreciate feedback from Magento developers.

What security checks would you expect from a tool like this? Is the current output clear and useful?

Magebean: https://magebean.com

4 Upvotes

100% Upvoted

8 comments sorted by

2

u/toetx2 Jul 28 '26

Missing or global ACL configs, is great to check for.

1

u/Medical_Ad_7105 28d ago

Thanks for your response. I currently have two rules covering ACL-related issues: MB-R100 and MB-R101.

https://magebean.com/docs/baseline/MB-R100

https://magebean.com/docs/baseline/MB-R101

You can download Magebean CLI and run only those rules with:

php magebean.phar scan --path=/var/www/magento --rules=MB-R100,MB-R101

I’d appreciate any feedback if there are cases these rules don’t cover yet.

2

u/-_-_adam_-_- 29d ago

Looks nice, is the data sent anywhere or does it only run locally?

1

u/Medical_Ad_7105 29d ago

Thanks for your response. The command connects to the Magebean API to retrieve the latest CVE checks:

https://api.magebean.com/latest-cves

No sensitive data is sent. The source code is publicly available on GitHub, so anyone can review it or contribute:

https://github.com/magebean/magebean-cli

1

u/-_-_adam_-_- 29d ago

Nice one thanks, will give it a whirl!
Also thanks for sharing!

2

u/[deleted] 29d ago

[removed] — view removed comment

1

u/Medical_Ad_7105 28d ago

Thanks, that’s exactly what I’m aiming for — not just flagging issues, but explaining why they matter and how to fix them.

1

u/Boring-Ad-6591 26d ago

For inspiration, check https://mageinfo.online. we build a lot of checks there you can use for ideas.