GP247 security

🌐 Language: 🇻🇳 Tiếng Việt · 🇬🇧 English (current) · 🇯🇵 日本語

GP247 security — what the system handles, what you handle

Introduction

This is the main page of the Security doc set for sites running GP247 / S-Cart. The doc set is for shop owners, administrators and technical staff (the people who install the site or manage the hosting or server). This page shows what GP247 already does for you, what only you can do, and which page to read next. You do not need to know programming to read it.

ℹ️ Why read this: most incidents on live sites are not caused by software bugs but by configuration: forgetting to back up the encryption key, leaving debug mode on while the shop is selling, keeping the default admin password, having a backup but never testing a restore. Software cannot do those things for you.

At a glance

Security of a site is a shared responsibility. GP247 handles the layers inside the application. The server, keys, backups and people are your part:

flowchart TB
    subgraph B["👤 Your part"]
        B1["Server & HTTPS"]
        B2[".env file & encryption key"]
        B3["Backup & test restore"]
        B4["Accounts & permissions"]
        B5["Software updates"]
    end
    subgraph G["✅ GP247 handles"]
        G1["Sign-in limits<br/>password hashing"]
        G2["Permissions<br/>per screen"]
        G3["Encrypted secrets<br/>in the database"]
        G4["Form forgery protection<br/>upload checks"]
        G5["Activity log"]
    end
    B --> S["Safe site"]
    G --> S
  • If either side is missing, the site is not safe: no software, however good, can save a leaked .env file or a backup that does not exist.
  • Your five most important tasks: run HTTPS, set APP_ENV=production + APP_DEBUG=false, back up .env (it holds the keys) and the database, replace the default admin account, update when a new version comes out.
  • GP247 is safe by default where it has control: the public API and MCP have their own switches, secrets are encrypted, every admin action is logged.
  • Fastest way to start: open the Security checklist and tick each item.

On this page

Who does what, by area

The table below splits the work by area. The "You must do" column lists the tasks no one else can do for you. Each row has a detailed guide.

Area ✅ GP247 does 👤 You must do Read more
Server configuration Turns debug off automatically when APP_ENV=production; the admin header shows the environment label and "DEBUG ON" Turn on HTTPS; point the document root to public/; APP_DEBUG=false; install without dev packages Production config
Keys & backup Encrypts secrets (SMTP password, secrets, licenses); keeps a copy of plugins/templates before updating them Back up .env, the database and uploaded images; test a restore; never regenerate the key on a running site Encryption keys & backup
Accounts & permissions Limits failed sign-in attempts; hashes passwords; permissions per screen; activity log Replace the default account; set a password policy; grant the least permission needed; lock the accounts of people who leave Accounts & permissions
Updates Releases security patches; safe update command; checks downloaded plugin packages Follow the release page; update GP247, PHP and the web server; install plugins only from trusted sources Updates & incidents
API & MCP On/off switches; tokens expire and are stored hashed; never broader than the admin screens Turn on only what you use; one token per application; revoke tokens you no longer use API · MCP
Incidents Activity log; command to change the encryption key without losing data Have a response plan; change passwords, revoke tokens and change keys in the right order Updates & incidents

Full list of built-in mechanisms, with the limits of each one: What the system protects.

Where to start — reading paths by role

Each role only needs to read a few pages, in this order:

You are Read in this order
Shop owner (not technical) Checklist → Accounts & permissions → Encryption keys & backup
Technical staff (install, hosting) Production config → Encryption keys & backup → Updates & incidents → Checklist
Just installed a new site Checklist, the "Right after install" section
Suspect the site was hacked Updates & incidents, the "If you suspect a breach" section
Plugin developer What the system protects → Sensitive data encryption → Creating a plugin

The Security doc set

Page Helps you
What the system protects Know exactly which protection layers are built in and their limits, so you do not wrongly think "installed means safe"
Safe production configuration Set .env correctly for a live site: debug, HTTPS, cookies, document root, folder permissions, Docker
Encryption keys & backup Understand APP_KEY and GP247_ENCRYPTION_KEY, back up the right things, move servers without losing data
Accounts & permissions Admin accounts, passwords, two-factor authentication, least permission, logs
Updates & incidents Follow security patches, update safely, steps to take when you suspect a leak
Security checklist Checklist by timing plus common mistakes, ready to print and tick

Security pages in other doc sets

Some topics already have their own pages. This doc set only summarizes them and links there, without copying:

Topic Page
Changing the encryption key safely, which data is encrypted Sensitive data encryption
Permissions, roles, admin users Admin permissions
Sign-in, tokens and limits of the REST API Sign-in, tokens and customer accounts through the API
Tokens, permissions and logs of MCP (AI agents) MCP security & permissions
Recommended versions, support lifecycle, PHP / web server patches S-Cart releases and security
Updating GP247 on a running site How to update GP247
The gp247:doctor diagnostic command CLI command reference

Reporting a security vulnerability

If you find a vulnerability in GP247, please email support@gp247.net. Do not open a public issue on GitHub, so the bug is not exposed before a patch exists. Patches are announced on the release page.

Conditions & Rules (know before you act)

  • The doc set describes the latest release: a site that has not been updated may lack some mechanisms. Check your site's version with php artisan gp247:info or the Server info screen.
  • Every mechanism has limits: the What the system protects page lists the limits of each one. Do not skip the "You must do" column just because GP247 already has a protection layer in the same area.
  • Third-party plugins and templates run code on your server: the protections in this doc set apply to the GP247 core. How safe a plugin is depends on whoever wrote it.

Q&A

Q1: I am not technical. What should I do first?

→ Open the Security checklist and finish the "Right after install" section. For any task that needs server access, send the checklist to whoever manages your hosting.

Q2: Once GP247 is installed, is the site safe?

→ Not yet. GP247 handles the layers inside the application; HTTPS, the .env file, backups and passwords are your part. See the Who does what table.

Q3: Which task is forgotten most often?

→ Backing up the .env file (it holds the encryption key) and testing a restore of the backup. If you lose the key, the saved SMTP password, payment gateway secrets and licenses all become empty. See Encryption keys & backup.

Q4: How do I know if the site has debug turned on?

→ Sign in to the admin: the header shows the environment label, plus a red "DEBUG ON" label when debug is on. How to turn it off: Production config.

Q5: Is there a command that checks the site for me?

→ Yes: php artisan gp247:doctor checks the environment, write permissions, the encryption key, and whether secrets can still be decrypted. It does not check HTTPS or APP_DEBUG; check those two yourself with Production config.

Q6: I use shared hosting and have no command-line access. What then?

→ Most tasks can be done in the hosting control panel (editing .env, turning on HTTPS, backups) and in the admin. Any page that needs the command line says so clearly.

Q7: I want to turn off the API and MCP completely because I do not use them?

→ Turn off the master switch on the API config screen. Turning off the master switch also turns off MCP. See Sign-in, tokens and customer accounts through the API.

Q8: I found a security bug. Where do I report it?

→ Email support@gp247.net. Do not open a public issue.

📅 Last updated: 2026-11-04 · ✍️ Author: GP247