Sample report
What a staging copy of WooCommerce, Magento 2 or Laravel carries
A report lists table and column names, counts, categories and evidence. It never contains the values the scanner sampled.
What the scanner prints
The WooCommerce scan below, as it appears in the terminal.
Platforms: WordPress (prefix wp_, db_version 60421) · WooCommerce 9.3.3 (prefix wp_, orders in HPOS tables) Scanned 28 tables · 9,100 rows sampled · 598 ms What a plain copy of this database would carry into staging CRITICAL 7 secret, key or token (7) HIGH 59 email address (24), secret, key or token (13), street address (11), phone number (5), payment token or ID (4), free text with personal data (1), password hash (1) MEDIUM 69 person name (20), IP address (11), city (7), postcode (7), user agent (6), free text with personal data (5), username (4), geolocation (3), secret, key or token (3), payment token or ID (2), session data (1) LOW 22 country (8), card details (4), region or state (4), company name (3), personal website (3) What staging could do to real people CRITICAL 6 subscription renewal payments are scheduled; staging would try to charge customers when they fall due HIGH Outgoing email is sent through WP Mail SMTP (mailer: sendgrid) HIGH Payment gateway "stripe" is enabled in live mode HIGH 2 active webhooks would send order and customer data from staging to their delivery URLs HIGH UpdraftPlus backups are scheduled and go to Amazon S3; staging would send its backups there too HIGH 2 WooCommerce Memberships emails are enabled; staging would send them to members, for example when a membership ends HIGH The copy keeps the live site's Jetpack connection; connected services would act for the live site, and WooCommerce Shipping, Tax or Payments are active MEDIUM 40 pending scheduled actions would run on staging (most common: woocommerce_cleanup_draft_orders (20), wc-admin_import_orders (14), woocommerce_scheduled_subscription_payment (6)) MEDIUM 5 WP-Cron events would run on staging, including UpdraftPlus backups, WPForms email summaries, WooCommerce usage tracking and Ultimate Member jobs (most common: um_daily_scheduled_events (1), updraft_backup (1), woocommerce_tracker_send_event (1)) MEDIUM WooCommerce emails store staff about new and cancelled orders; staging would email them too MEDIUM 1 plugin setting sends notification emails to staff addresses (for example fixture_admin_recipient) MEDIUM 1 Contact Form 7 form emails its submissions to the addresses in its settings
Real output, trimmed. Reports list names, counts and categories. They never contain the values the scanner sampled.
WooCommerce: 28 tables, 9,100 rows sampled
WordPress with WooCommerce 9.3.3, orders in HPOS tables, on MariaDB 11.8.9.
What staging could do to real people
| Severity | What | Where | Fix in the copy |
|---|---|---|---|
| Critical | 6 subscription renewal payments are scheduled; staging would try to charge customers when they fall due | wp_actionscheduler_actions woocommerce_scheduled_subscription_payment | Cancel these actions in the copy, or make sure WooCommerce Subscriptions starts in staging mode |
| High | Outgoing email is sent through WP Mail SMTP (mailer: sendgrid) | wp_options wp_mail_smtp | Point the mailer at a mail catcher such as Mailpit, or turn it off, in the copy |
| High | Payment gateway "stripe" is enabled in live mode | wp_options woocommerce_stripe_settings | Switch the gateway to test or sandbox mode and remove the live keys in the copy |
| High | 2 active webhooks would send order and customer data from staging to their delivery URLs | wp_wc_webhooks | Set status to 'disabled' (or delete the rows) in the copy |
| High | UpdraftPlus backups are scheduled and go to Amazon S3; staging would send its backups there too | wp_options updraft_service | Remove the remote storage in UpdraftPlus's settings in the copy, or turn its backup schedule off |
| High | 2 WooCommerce Memberships emails are enabled; staging would send them to members, for example when a membership ends | wp_options | Turn these emails off in WooCommerce > Settings > Emails in the copy, or route mail to a catcher such as Mailpit |
| High | The copy keeps the live site's Jetpack connection; connected services would act for the live site, and WooCommerce Shipping, Tax or Payments are active | wp_options | Disconnect the copy: delete the blog token in jetpack_private_options and the auth entry in woocommerce_helper_data, or define JETPACK_STAGING_MODE in its wp-config.php |
| Medium | 40 pending scheduled actions would run on staging (most common: woocommerce_cleanup_draft_orders (20), wc-admin_import_orders (14), woocommerce_scheduled_subscription_payment (6)) | wp_actionscheduler_actions | Cancel pending actions in the copy, or turn off WP-Cron and Action Scheduler there |
| Medium | 5 WP-Cron events would run on staging, including UpdraftPlus backups, WPForms email summaries, WooCommerce usage tracking and Ultimate Member jobs (most common: um_daily_scheduled_events (1), updraft_backup (1), woocommerce_tracker_send_event (1)) | wp_options cron | Turn cron off on the copy's host (DISABLE_WP_CRON stops runs on page loads, not a system cron), and change the plugins' own settings, since they schedule their events again |
| Medium | WooCommerce emails store staff about new and cancelled orders; staging would email them too | wp_options woocommerce_new_order_settings | Set these emails to off in WooCommerce > Settings > Emails in the copy, or route mail to a catcher such as Mailpit |
| Medium | 1 plugin setting sends notification emails to staff addresses (for example fixture_admin_recipient) | wp_options | Point these settings at a test address, or route mail to a catcher such as Mailpit, in the copy |
| Medium | 1 Contact Form 7 form emails its submissions to the addresses in its settings | wp_postmeta _mail | Route mail to a catcher such as Mailpit in the copy, or add demo_mode: on to each form's Additional Settings |
A few of the 157 findings
| Severity | Where | Data | Evidence | Suggested mask |
|---|---|---|---|---|
| Critical | wp_options.option_value[woocommerce_stripe_settings] → secret_key | secret, key or token | name contains "secret key"; secret formats found: Stripe secret key (1 live) | null |
| Critical | wp_options.option_value[wp_mail_smtp] → sendgrid.api_key | secret, key or token | name contains "api key"; secret formats found: SendGrid API key (1 live) | null |
| High | wp_options.option_value[logged_in_salt] | secret, key or token | known field (wordpress preset); authentication key or salt; a copy that keeps it trusts production login cookies | null |
| High | wp_commentmeta.meta_value[akismet_as_submitted] → comment_author_email | email address | name contains "email"; 121 of 121 sampled values match the email address format | fake_email |
| Medium | wp_commentmeta.meta_value[akismet_as_submitted] → comment_content | free text with personal data | name contains "comment"; of 121 sampled text values, 8 contain email addresses, 10 contain phone numbers | redact |
Magento 2: 17 tables, 2,895 rows sampled
Magento 2 with two store views, on MariaDB 11.8.9.
| Severity | What staging could do | Where | Fix in the copy |
|---|---|---|---|
| High | Payment method "braintree" is active in live mode | core_config_data payment/braintree | Switch it to sandbox or test mode and replace the live credentials in the copy |
| High | 7 order emails are queued; with asynchronous sending, staging cron would send them to customers | sales_order | Set send_email = 0 on unsent orders in the copy |
| Medium | Email sending is on (system/smtp/disable is not set) | core_config_data system/smtp/disable | Set system/smtp/disable to 1 in the copy, or route mail to a catcher such as Mailpit |
| Medium | 50 pending cron jobs would run on staging (most common: sales_send_order_emails (24), indexer_reindex_all_invalid (17), newsletter_send_all (9)) | cron_schedule | Empty cron_schedule in the copy and keep cron off until the copy is checked |
It also made 87 findings of personal data or secrets, among them sales_order_payment.cc_number_enc. That card number is encrypted with the store's crypt key, which a copy usually shares. It confirmed 9 relationships that the schema never declared, such as sales_order.customer_id → customer_entity.entity_id.
Laravel: 12 tables, 1,094 rows sampled
| Severity | What staging could do | Where | Fix in the copy |
|---|---|---|---|
| Medium | 12 queued jobs would run when a queue worker starts on staging (queues: default (6), emails (6)) | jobs | Empty the jobs table in the copy |
It also finds personal data hiding in JSON: customer emails in queued job payloads and notification data, and failed job stack traces that contain email addresses. It suggests emptying failed_jobs, password_reset_tokens, personal_access_tokens and sessions in any copy.