Security Model

Security Model

  • Super Users only, by default -- a fresh install denies access to the standard Manager and Administrator groups automatically.
  • Joomla ACL -- access is governed by Joomla authentication and component permissions.
  • CSRF protection -- delete, clean, settings, false-positive, and AI assistant actions all require Joomla CSRF validation.
  • Scoped deletion -- the scanner can only remove items flagged by the current scan run.
  • Scans its own files too -- no blanket self-exemption, only specific verified false positives are excluded.
  • AI file access is fenced in code -- the assistant's deny list for Joomla core, configuration.php, entry points, and MuRu Guard's own files is enforced in PHP before any file operation runs.
  • Every AI file change is logged -- creates, edits, renames, and deletes are written to an audit log with the approving Joomla username and a timestamp.
  • Pattern-only cleaning -- menu params cleanup strips matched injection patterns without touching unrelated layout settings.
  • Read-only scanning -- file content is read as text for pattern matching and never executed or included.
  • Admin-only operation -- no separate public scanner file, login screen, or access key is exposed.