Connector hardening tests¶
Patcherly runs both manual and automated security checks on every connector release (as well as app dashboard and API). Checks run both locally through custom pentesting suites (we throw everything in the book at it) and CI, against a min security (worst case scenario) test environment. This keeps hardening consistent; it is not a certified pen test.
If someone has full access to your server, they can already change, exfilter, damage or read the files and data on it. Hardening and keeping your own environment, apps and tools safe, remains your own responsibility.
Last verified: 2026-09-23 · Connectors 2.10.2
| What we check | Why it matters | How we close it |
|---|---|---|
| Unsigned or forged file reads | Stop strangers from pulling source via the connector | Reject requests without a valid signature |
| Replayed or reused signatures | Stop replaying an old request or pointing it at the wrong URL | Short time window; signature tied to the intended request |
| Clock-skew tricks | Stop forged timestamps that dodge the replay window | Timestamp required and accepted only within a few minutes either way |
| Wrong HTTP methods | Stop casual probes from returning file content | Only a signed write method is accepted |
| Paths outside the site | Stop escape to system files or sibling apps | Resolve real paths; allow only configured roots |
| Symlinks that leave the jail | Stop a project-looking path that opens host secrets | Follow links, then re-check the real location |
| Patches aimed outside the site | Stop a bad fix from writing outside allowlisted roots | Same path jail on apply |
| Shell tricks in post-apply steps | Stop chained commands and unknown binaries after a fix | Denylist plus allowlisted binaries only |
| Tampered fix payloads | Stop flipping one byte of a signed patch | Reject when the signature no longer matches |
| Wrong file for this error (WordPress) | Stop a valid signature from reading unrelated plugin files | Paths must be registered for that error |
| Credential files on disk | Reduce casual local theft of connector secrets | Owner-only permissions; never served over HTTP |
| Local helper ports | Stop exposing approve helpers on the public network | Bind to localhost; require two independent auth checks |
Related: Security overview · Post-apply restart safety · Connectors overview
Need a deeper vendor pack? Email [email protected].