Security questions

I often get the question...

How secure is the CMS solution you offer?

In order to provide answers to this, I was wondering if those most familiar with the security code and overall architecture of the system might do a brain dump on this topic. Some points to consider:

* How vulnerable to various types of attacks is MODx, including but not limited to, SQL injection techiques, PHP file exploitation, etc.?
* Are there any ways to thwart DoS attacks?
* Anything else security related...

Anyone have any input on this?

Indeed, this is a serious issue that should not be overlooked; the cheap mass hosting company that I use has banned all the *nuke variants because of security issues.

* How vulnerable to various types of attacks is MODx, including but not limited to, SQL injection techiques, PHP file exploitation, etc.?

Pretty good on this one. Snippets that uses web forms would have to be double checked.

* Are there any ways to thwart DoS attacks?

How would we safe guard MODx against such? Any proposals?


Best regards,

* Are there any ways to thwart DoS attacks?

How would we safe guard MODx against such? Any proposals?

This seems like it would be fairly straight forward to do by monitoring the used db connections and rate limiting how fast new ones could be spawned off. Without looking at the code in depth, I suspect that's the point where the majority of DoS attacks would be most effective