# The 2024 Backstage Security Audit

DevFeed: [The 2024 Backstage Security Audit](<https://devfeed.tech/articles/the-2024-backstage-security-audit-12107.md>)

Original publisher: [Read original article](<https://backstage.io/blog/2024/12/17/backstage-security-audit-2024>)

Author: Patrik Oldsberg, Spotify

Published: 2024-12-17T00:00:00Z

Content type: article

Language: en

Sources: [Backstage Software Catalog and Developer Platform Blog](<https://devfeed.tech/sources/backstage-software-catalog-and-developer-platform-blog.md>)

Topics: [Backstage](<https://devfeed.tech/topics/backstage.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [audits](<https://devfeed.tech/tags/audits.md>), [backstage](<https://devfeed.tech/tags/backstage.md>), [developer-experience](<https://devfeed.tech/tags/developer-experience.md>), [developer-portal](<https://devfeed.tech/tags/developer-portal.md>), [idp](<https://devfeed.tech/tags/idp.md>), [internal-developer-platform](<https://devfeed.tech/tags/internal-developer-platform.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [platform-engineering](<https://devfeed.tech/tags/platform-engineering.md>), [report](<https://devfeed.tech/tags/report.md>), [secure-by-default](<https://devfeed.tech/tags/secure-by-default.md>), [security](<https://devfeed.tech/tags/security.md>), [software-catalog](<https://devfeed.tech/tags/software-catalog.md>), [software-templates](<https://devfeed.tech/tags/software-templates.md>), [techdocs](<https://devfeed.tech/tags/techdocs.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

Backstage's second independent security audit found three high-severity and one medium-severity vulnerability, plus seven side findings without direct security impact. The main findings were fixed in Backstage 1.31, and most side findings were addressed in 1.32. The article also discusses improvements to secure coding practices, threat modeling, authentication, and TechDocs path handling.

## Source excerpt

TL;DR Backstage's security posture remains strong! Today, we're releasing the report from the second independent security audit of the Backstage project.