> For the complete documentation index, see [llms.txt](https://support.storefront.co.za/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.storefront.co.za/release-notes/may-2026/penetration-test-security-remediation.md).

# Penetration Test Security Remediation

Fixed several security issues from a penetration test: session cookies missing secure flags, an XSS risk in the wishlist name field, and unsanitized HTML in text fields — now validated and secured.

**This includes:**

* Session cookies now set with secure flags
* Fixed cross-site scripting (XSS) risk in the wishlist name field
* Added input validation to reject unsanitized HTML in text fields

**How it benefits the Merchant**

Closes security vulnerabilities identified in a penetration test

Reduces the risk of data exposure or malicious script injection on the storefront

**Potential FAQs**

Q: Do I need to take any action to get these security fixes?\
A: No — the fixes apply automatically, including secure cookie flags and input validation.

Q: Was any customer data compromised by these vulnerabilities?\
A: The description doesn't indicate any confirmed compromise — these were issues identified proactively during a penetration test and have now been fixed.