Security and compliance

Every statement on this page describes what the code does today. Where something is not the case, it says so.

What Magekwik is, and is not

Magekwik is a passive scanner and monitoring service for Magento 2 and Adobe Commerce storefronts. It is not a PCI Approved Scanning Vendor (ASV) and not a Qualified Security Assessor (QSA). Its reports are not a PCI DSS certification or attestation, and nothing here states that any store is compliant.

What it can do is support a merchant's own evidence. The script inventory and the live script reports speak to PCI DSS requirement 6.4.3 (scripts on payment pages are inventoried and authorised). Payment-page change monitoring speaks to requirement 11.6.1 (changes to payment pages are detected and alerted on). Neither is the complete mechanism the standard describes. Our own scans reach only what a visitor sees before the cart, and live script reports cover only scripts outside the store's whitelist. Whether a store meets either requirement is for the merchant and their assessor to decide.

Magekwik is not an ASV because ASV scanning is intrusive vulnerability scanning of the cardholder data environment, and Magekwik deliberately does not do that. It reads what a store already publishes.

How a scan behaves

• Requests are read-only GET and HEAD. A scan sends no POST, writes nothing, attempts no login, no exploitation and no brute force. The engine's only door to the network has no method for a write, and its tests fail if a check issues anything else.
• Requests to one host are spaced at least 0.3 seconds apart, and the whole scan is bounded by a 90-second budget. Each check also has its own time limit, and one failing check does not stop the others.
• Addresses that resolve to private, internal, loopback or link-local ranges are refused before anything is sent.
• Deeper checks run only on domains the requester has verified they control.
• It names itself. The user-agent is MagekwikScanner/1.0 (+https://scan.magekwik.com; passive security audit), requests are signed with Web Bot Auth (RFC 9421), and the source addresses are published at /ipranges.json. The crawler page shows how to verify a request and how to refuse one with robots.txt.

Your data

• Hosting. Hetzner, in Germany (EU).
• Processors. Brevo for email, Hetzner for hosting and Stripe for payments. The full list is in the privacy policy.
• Card details. Stripe holds them. Magekwik never sees them.
• Secrets are stored as hashes. Report links, Report URI tokens, API keys and sign-in links are kept as SHA-256 hashes, so Magekwik cannot reconstruct them.
• Alert channels are encrypted. The Slack, Microsoft Teams or webhook address and any secret on it are stored encrypted.
• No passwords. Sign-in is by emailed link, so there is no password to leak.
• No advertising or analytics third parties. The site loads its own fonts and scripts from its own origin.

Live script reports and privacy

Pro stores can point their Content Security Policy Report URI at Magekwik. Visitor IP addresses are used only to compute a keyed hash, with an IPv6 address counted by its /64 network. The hash is deleted after 24 hours and the address itself is never stored. A kept sample holds the origin of a blocked script or connection and never its path or query string. Anything an attacker places in a URL, card data included, is discarded before storage. The store owner is the controller of their visitors' data and Magekwik is the processor. Details are in the privacy policy.

In transit

The site is served over HTTPS with HTTP Strict Transport Security (max-age=31536000; includeSubDomains). The report endpoint answers every report with 204, whether it was stored or not, and sets no cookie.

Certifications

Magekwik does not currently hold ISO 27001, SOC 2 or Cyber Essentials certification. This page will say so when that changes.

Report a vulnerability

Write to support@magekwik.com. The same contact is in security.txt. Please give us a reasonable time to fix a problem before you disclose it. We will take no action against good-faith research that stays within our own service and does not touch customer data. This is a statement of intent and no reward is offered.