Shopware Extension Security

Build and improve Shopware extensions so they preserve Shopware's authorization, data-isolation, input-validation, rendering, and secret-management boundaries. Use released Shopware advisories as regression lessons for extension code, not as the primary target of the review.

Scope

Apply this skill when the user asks to:

• implement a security-sensitive feature in a Shopware plugin or app;
• review or harden an existing extension;
• fix a security finding in extension code;
• assess an app manifest, app backend, custom API route, DAL entity, webhook, Twig template, Administration module, upload, or external integration;
• add security regression tests to an extension.

Identify the extension model first. Plugins run inside Shopware and can reach the service container, filesystem, database, events, and request context. Apps run remotely or through sandboxed app features and rely on manifest permissions, signed communication, per-shop credentials, and API boundaries. Review hybrid extensions along both paths.

Workflow