Server-side ecommerce security

Find malicious files,
host exposure, and
store compromise evidence.

EcomScan is a host-resident Go scanner plus a tenant-isolated API and dashboard. It evaluates ecommerce files, optional platform databases, component vulnerabilities, file changes, and supported host evidence — then uploads the structured result for investigation.

Create workspace →Install the agent
Go agent
server-side, no browser tag
Layered
hash, signature, YARA, heuristic
Signed
versioned detection bundles
ecomscan · scanillustrative output
$ ecomscan --key=<agent-key> /var/www/html platform woocommerce files scanned 18,420 engines signatures · hashes · heuristics · IOC · YARA database inspected with --db-scan host checks exposure · persistence · processes critical findings 1 high findings 1 upload accepted by API next review linked evidence in dashboard
Implemented capabilities

Detection on the host, evidence in the API.

Each surface below maps to code and API records in the current product. Remediation remains operator-controlled.

F

Layered file scanning

Content signatures, MD5/SHA-256 hashes, IOC matches, heuristics, delta evidence, and optional YARA evaluate PHP, JavaScript, HTML, and related files.

normalized findings · confidence · severity
D

Platform database checks

Explicit database scans inspect WordPress/WooCommerce and Magento data using credentials parsed from the local platform configuration.

opt-in with --db-scan
H

Host evidence

Supported hosts add exposed-service, persistence, and active-process observations to the scan result without claiming automatic containment.

exposure · persistence · processes
V

Component vulnerability audit

Platform inventory and vulnerability data identify affected components, known CVEs, CVSS context, and exploit-in-the-wild signals where available.

WordPress · Magento · KEV context
I

Signed intelligence bundles

The API publishes versioned bundles of active hashes and signatures. Agents verify Ed25519 signatures and can fall back to a previously verified cache.

versioned · staged · verified
R

Incident and fleet workflow

The dashboard exposes stores, scans, findings, alerts, incidents, shared threats, runbook checklists, compliance checks, and exportable API data.

assign · note · prioritize · resolve
Monitor mode

File changes plus periodic verification.

Monitor mode watches the configured path and logs filesystem events locally, reports agent health, and uploads periodic scan results on the configured interval. It must be started explicitly by the operator or a service manager.

  • Local filesystem create, write, rename, and removal events
  • Periodic full scans to catch missed or contextual changes
  • Store-scoped keys and tracked agent instances
  • Signed request support for mutating agent uploads
agent workflowserver-side
create store POST /api/v1/stores create agent key POST /api/v1/keys install signed release download scan POST /api/v1/scans/results monitor local fsnotify + periodic scan uploads heartbeat POST /api/v1/agents/heartbeat
Integrations

Configure and test external destinations.

The dashboard can store provider configuration, validate credentials, and send manual test payloads for Slack, PagerDuty, Jira, Splunk, Datadog, Elastic, Microsoft Teams, and generic webhooks. Cloudflare credentials can be validated. Automatic event dispatch and firewall blocking are not enabled yet.

Browser monitoring · roadmap

Current detection is server-side.

EcomScan does not currently instrument checkout form fields, observe browser network egress, apply CSP, or block exfiltration at the edge. Those capabilities require a separate browser collection and privacy design before they can be represented as product features.

available now server files · databases · components · host evidence not available DOM hooks · browser egress · edge blocking · AI analysis
Start with the API-backed path

Create a store, issue an agent key, and run a server scan.

The generated key response includes the install, scan, and monitor commands for that store.

Create workspaceRead docs