Is Kirby secure?

[marianoviola]

@bastianallgeier

Something I can’t really controll is the code quality of plugins and of templates. Especially unfiltered and unsanitized input can do a lot of harm to any system. Kirby is no exception here. I can maybe only give more hints how to write secure frontend forms and stuff like that and how to use Kirby’s toolkit and other tools to filter input.

Probably I asked about CSRF protection in the wrong place but then I found an answer by myself.

The toolkit provides a csrf() helper but unfortunately it is still undocumented. I think that using CSRF protection is one of the basic tools, along with input validation and sanitization, that helps to create secure themes and plugins.