PENTESTY · EDITORIAL ANALYSIS · · 4 min read
Magento: what does a scan without alerts actually establish?
A page can behave differently between visits. Connect content review with observed browsing and the authority that allows changes to be published.
By Pentesty
The scope of the published research
An October 27 news report prompted this analysis. In its October 24 research, Sansec reports observing 953 stores in the campaign since July 2025, mostly Magento; 83 loaded the latest domain. It describes responses selected according to the browser and had not captured that stageâs final payload. The count does not establish affected shoppers or stolen cards.
Define the purchase journey to observe
Start with an authorized journey: open a product, add it to the cart and reach payment in a representative environment. Use fictional accounts, orders and data. Define pages, owners and the expected outcome, including necessary integrations.
Record the browser, time, authentication state and starting conditions. Compare the received page with approved content and identify the network destinations required for the operation. A difference calls for investigation; commercial personalization can be legitimate. Our article on the quality of pentest evidence helps communicate these conditions and limits.
Compare new and returning visits
The browser documentation explains that local storage data can remain between sessions. For the exercise, separate a clean profile from a reused one, both controlled by the team. Document what each profile contained before browsing. Restarting the browser alone does not establish the same starting conditions.
Preserve the evidence before clearing the test profile. After an approved fix, compare the journeys again and check which data and requests remain. This sample does not reproduce every customer. Choose profiles to answer an explicit hypothesis, and record the combinations not examined as open work.
Connect published content with permission to change it
Select the CMS blocks and pages used along the journey and connect the published version to its authorized change. Check unexpected modifications with marketing, development and operations. Record who approved the content and which accounts, integrations or processes could replace it. Retain a restricted copy of suspicious material, avoiding broadly accessible tickets.
Removing a snippet should be accompanied by an assessment of write authority. Review administrative access and integrations within the agreed scope, with the application ownerâs support. The relationship between a component update and the actual service also appears in our analysis of running PHP. Store validation adds content, permissions and browser behavior.
Verify how controls affect the operation
Adobe distinguishes reporting from restrictive CSP: reporting a violation does not block the resource. During assessment, record the policy the browser actually received and how events were handled. Interpret a dashboard with few warnings alongside collection coverage and conditions.
Validate policy changes through an authorized journey, with continuity criteria for payment, customer service and necessary integrations. Avoid broadening permissions merely to silence an alert. For each exception, record the destination, rationale, owner and planned review. Record behavior after the change and functions not examined.
Deliver a conclusion another team can check
Create a short record connecting the observation to the decision. Retain enough metadata to repeat the sample, with restricted access to technical details. Exclude real shopper data from evidence whenever it is unnecessary. Refer suspected earlier access to its own investigation, with an owner and stated time coverage.
- Sample: pages, test profiles, time and completed legitimate operation.
- Content: approved version, differences examined and owners of acceptance.
- Authority: reviewed access, changes performed and remaining exceptions.
- Conclusion: observed result, limitations and the condition for reassessment.
Frequently asked questions
Does a scan without alerts allow the investigation to close?
Record the result and its conditions. Closure also requires assessing the existing indicators, collection coverage and open work assigned to responsible owners.
Does the test require real payment data?
Plan an authorized operation with fictional data and a representative environment. Agree with operations which functions can be exercised and which limits affect the conclusion.
How should we choose between a clean and a returning profile?
Use both when the hypothesis depends on browser state. Document each starting state, preserve the records and compare the same journeys after the change.
What evidence should accompany removal of suspicious content?
Connect the approved change with a new observation and a review of who could write the content. State which access and journeys remained outside the assessment.
Sources and references
- Sansec: store campaign research, October 24, 2026
- MDN: local storage across browser sessions
- Adobe: CSP reporting and restrictive modes
- Cyber Security Brazil: editorial news reference
Original Pentesty analysis, published October 27, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.