Markus Michalski FAQ

Sylius Admin: Security and Privacy

Security of Sylius Admin: where credentials are stored, token handling, path allowlist, delete protection, image upload restriction, stage/prod separation, what is logged and which data leaves the machine.

Deutsche Version

Back to overview

Sylius Admin: Security and Privacy

This documentation always describes the latest published version.

Credentials

Aspect Behavior
Storage location Plain text in the .env file of the environment: ~/.claude-plugin-syliusadmin/<stage or prod>/.env. The plugin directory itself contains no credentials.
Transmission Email and password go only to <SYLIUS_BASE_URL>/api/v2/admin/administrators/token. Use an https:// URL; the server does not enforce this.
Token The JWT lives only in the memory of the server process. It is renewed 30 seconds before expiry; if the token has no expiry, 300 seconds apply. It is never written to disk.
Stage key SYLIUS_API_KEY is sent as the X-Stage-Api-Key header on every request, including login.
Setup skill Never fills in credentials for you.

Protect the .env files with file permissions, keep them out of any repository and do not pass them on.

Logging

The server writes no log of its own and does not output credentials. The configuration class hides password and API key in its text representation so they do not appear in error output either. An error from the Sylius API is returned to Claude as a message and contains method, path, environment and at most the first 500 characters of Sylius' response.

Which data leaves the machine

Data Destination
Tool calls and results (product texts, prices, codes) Part of the conversation with Claude and therefore sent to Anthropic.
Requests to the Admin API To the configured SYLIUS_BASE_URL only, nowhere else.
Uploaded image files The bytes go to the shop, not into the conversation.
Credentials Only to the shop (login), never to Claude.

The server contains no telemetry and no other external calls.

Safeguards in the server

All tool parameters are treated as untrusted because a language model supplies them.

Safeguard Effect
Path allowlist Every request is checked against a fixed list of permitted resources before it is sent. Allowed are products, variants, categories, attributes, options, zones, countries, shipping methods, shipping categories, tax categories and marketplace links; channels and input field definitions read-only; plus the login endpoint. Everything else (orders, customers, promotions, admin users) fails with SyliusScopeError.
Path checks Paths containing .., //, ?, # or % are rejected. Codes may only contain letters, digits, underscore and hyphen.
Delete protection DELETE is only allowed for marketplace links; the client rejects it for every other resource.
Method override Form fields starting with _method are rejected so a POST cannot turn into a DELETE.
Image upload See below.
Environment cross-check If SYLIUS_ENV_NAME does not match SYLIUS_ENVIRONMENT in the file, the server does not start.
Activation guard A product without a variant is not activated.

In the Community Edition the Sylius admin user itself always has full access. The allowlist is the only boundary of the server, not a permission in Sylius. Anyone who can read the .env file can log in to the Admin API directly with the same rights.

Image upload

A file path arrives as a tool parameter from the language model and could be slipped in by manipulated content (for example in an ingested product description). Without restriction that would allow reading any local file and publishing it publicly in the shop. Therefore:

Recommendations

© 2026 Markus Michalski | Back to Homepage | Impressum | Datenschutz