Current articles
Signals of Technical Debt in a Mature Magento Store
Mature Magento stores accumulate debt with recognizable signals across code, database, logs, and frontend. Here is how to read the pattern and act on it.
Jason Schuman · July 29, 2026
When to Replace, Isolate, or Remove an Extension
Finding a bad extension is half the work. Here is the framework for deciding whether to update, replace, isolate, or remove it, by need and risk.
Jason Schuman · July 19, 2026
Magento Upgrade and Patch Readiness as Practice
Upgrades hurt most when they are rare. Here are the update types, the tools that predict what breaks, and the readiness practice that keeps a store current.
Jason Schuman · June 30, 2026
Unsafe Direct Database Writes in Custom Modules
Custom code that writes raw SQL to core tables skips validation, indexing, and cache, and can open injection. Here is how to find it and the right approach.
Jason Schuman · June 27, 2026
Ranking Magento Technical Debt by Real Cost
You cannot fix every module at once, so you rank them. Here is how to inventory Magento modules and score them by upgrade risk, blast radius, and support cost.
Jason Schuman · June 24, 2026
Extensions That Rewrite Core or Stack Around-Plugins
Class rewrites and around-plugins couple extensions to core internals and break on upgrades. Here is how to find them and build a coupling risk inventory.
Jason Schuman · June 20, 2026
Reducing Magento Extension Footprint Safely
Most stores can shrink their extension count without losing a feature customers use. Here is how to find the removable ones and take them out safely.
Jason Schuman · June 15, 2026
Module Dependency Conflicts Revealed by Composer
When Composer refuses to install, it found a dependency conflict. Here is how to read it, the commands that reveal it, and why forcing past it is a trap.
Jason Schuman · June 13, 2026
Registration Spam and Bot Load as a Health Issue
Bot registrations, spam carts, and card testing add load, bloat tables, and skew data. Here is how bot abuse hurts platform health and how to reduce it.
Jason Schuman · June 8, 2026
When Magento Module Count Becomes a Risk
The risk is not one extension, it is the count. Here is how module count turns into slow compilation, long plugin chains, and conflicts, and how to reduce it.
Jason Schuman · June 5, 2026
Magento Security Health: Outdated and Vulnerable Parts
Most breaches use disclosed, patchable vulnerabilities nobody applied. Here is how to check Magento, extensions, and PHP for known risk and rank the fixes.
Jason Schuman · June 2, 2026
Custom Code Without Service Contracts or DI
Custom code that ignores service contracts and dependency injection ages badly: fragile on upgrades and hard to test. Here is how to recognize it in a review.
Jason Schuman · June 1, 2026
Preference vs Plugin vs Observer in Magento 2
Preference, plugin, or observer: the mechanism a custom module picks decides its upgrade cost. Here is when each is right and the anti-patterns we audit for.
Jason Schuman · May 20, 2026
Magento 2 security: verifying ACL protection in custom Admin modules
A custom Magento Admin module is not secure merely because it declares an ACL resource. Sensitive backend access must be tested against restricted roles and validated after deployment.
Jason Schuman · April 15, 2026
Exception Handling in Custom Magento Logic
Custom code that swallows exceptions or crashes the wrong flow turns small problems into big ones. Here are the common mistakes and how to spot them.
Jason Schuman · April 14, 2026
Core Overrides That Block Security Patches
A patch you applied may not protect you if an override runs instead of the fixed code. Here is how overrides neutralize patches and how to verify coverage.
Jason Schuman · February 27, 2026
Auditing Magento Extension Health and Update Status
Third-party extensions run with core privileges but update on the vendor's schedule. Use Composer to find outdated, vulnerable, and upgrade-blocking packages.
Jason Schuman · January 4, 2026
Spotting Abandoned Magento Modules Before Outages
Abandoned custom modules keep running until an upgrade or traffic spike breaks them. Here is how to find them in config, git history, and setup_module.
Jason Schuman · December 15, 2025
Magento 2 Core File Integrity Checks on 2.4.x
Magento 2 has no built-in checksum tool. Here is the diff-against-clean-install method we use to catch hand-edited vendor code during an audit.
Jason Schuman · December 1, 2025
Security and module risks we investigate
Admin authorization boundaries
Validate that ACL resources, controller enforcement, and role behavior produce deterministic denied access where required.
Custom module exposure
Identify backend routes, actions, and module features that can expose sensitive operations without explicit authorization testing.
Role and permission drift
Detect production role configurations and stored rule states that diverge from expected least-privilege access behavior.
Security verification workflow
Strengthen deployment QA with allowed/denied role testing, direct URL checks, and repeatable access-control verification steps.
Need clarity on custom module security risk?
A forensic platform audit can evaluate custom Magento modules, Admin access controls, extension exposure, authorization behavior, and the technical risks affecting sensitive platform operations.
Request Platform Audit