Specific hardening tasks for a production Backstage, taken from the project's threat model: proxy and scaffolder risks, URL readers, frontend exposure, audit logging, keys, secrets, patching and catalog registration.
Turning the project's threat model into a checklist: trust levels, network exposure, plugin vetting, permissions, auth providers, URL readers and resource exhaustion, with who owns each item.
Why injecting credentials through the proxy exposes upstream APIs to every user, allowedMethods and path limits, scoping injected tokens, and moving integrations into dedicated backend plugins.
Reducing what a template can break: templates running on the host, elevated scaffolder credentials, user tokens instead of shared service credentials, auditing installed actions and restricting template authors.
Preventing server-side request forgery through URL readers and $text references: allow-listing hosts, blocking cloud metadata endpoints, and why readers bypass permissions.
The sign-in page does not protect the JavaScript bundle: what the experimental public entry point splits, when an authenticating proxy is the simpler fix, and what the bundle can reveal.
Recording security-relevant events: what the auditor service captures, severity levels and log level mappings, shipping audit events to a SIEM and which plugins emit them.
Why auto-generated keys reset on restart, configuring static user and plugin key stores, ES256 key pairs, rotation by adding keys and protecting the private keys.
Keeping tokens out of app-config files: environment variable substitution, Kubernetes Secrets with encryption at rest, SealedSecrets or an external secrets manager, and rotating integration tokens.
Staying inside the six-month backport window: Dependabot, Renovate or Snyk on the app repository, reading Backstage security advisories, and patching third-party plugins that lag behind.
Stopping anyone from registering Users, Groups or Templates: catalog rules for allowed kinds per location, permission policies for create and delete, read-only mode, and trusted org data sources.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.