{"slug": "announcing-medusa-security", "title": "Announcing Medusa Security", "summary": "Medusa launched Medusa Security on November 5, 2026, a suite of five managed security features on Medusa Cloud, with Medusa Instant Protection as its centerpiece: it blocks exploits against Medusa and NodeJS vulnerabilities at the edge before customers upgrade. The suite also includes a Basic Protection Ruleset, DDoS protection, bot detection that still admits verified crawlers such as search engine crawlers, and a database IP allowlist, with the first four enforced at the edge. Medusa Security is automatically enabled for all new projects, while existing projects get only Instant Protection by default until a second phase a few weeks later, when all protections are switched on automatically and can no longer be disabled.", "body_md": "[Blog](https://medusajs.com/blog)\n\nNovember 5, 2026·Product\n\n# Announcing Medusa Security\n\nPedro Guzmán\n\nPedro Guzmán\n\nMedusa Security is a new suite of managed security features on Medusa Cloud. It includes Medusa Instant Protection, which blocks exploits against Medusa before you upgrade, plus DDoS protection, bot detection, a database IP allowlist, and more.\n\nMedusa Security is now available on Medusa Cloud. It adds managed security features to the traffic reaching your Medusa applications.\n\nAI agents now analyze and change software faster than ever. That speeds up how quickly vulnerabilities are discovered and increases the volume of automated traffic hitting public applications. Modern JavaScript applications also rely on large dependency graphs that change constantly.\n\nWe don't think every team building on Medusa should have to assemble its own security stack. Firewall rules, DDoS mitigation, and bot protection should come with the platform.\n\n## What Medusa Security includes\n\nMedusa Security includes five features:\n\n- **Medusa Instant Protection:** Blocks requests that try to exploit vulnerabilities and attack patterns common to Medusa applications. E.g. exploitable vulnerabilities in Medusa or NodeJS would be blocked before you've had a chance to upgrade.\n- **Basic Protection Ruleset:** Blocks requests that try to exploit common web attacks and widely exploited vulnerabilities.\n- **DDoS protection:** Detects and mitigates distributed denial-of-service attacks at the network and application levels.\n- **Bot detection:** Blocks requests from malicious bots, while letting verified bots such as search engine crawlers through.\n- **Database IP allowlist:** Restricts public access to your environment's database, or allows access only from the IP addresses you specify.\n\nThe first four run at the edge, so malicious requests are stopped before they even reach your application.\n\n## Medusa Instant Protection\n\nMedusa Instant Protection is the most important part of the product.\n\nWe build both the commerce framework and the Cloud platform. That lets us turn vulnerabilities identified in Medusa into protections enforced at the edge.\n\nWhen we discover a new attack vector affecting Medusa, we deploy a mitigation before malicious traffic reaches applications running on Medusa Cloud. Your applications are protected even before you upgrade to a version that fixes the vulnerability. You should still update regularly to get the fix in your codebase.\n\n## Analytics\n\nYou can see how rulesets are being applied on your traffic in the Security Analytics page. It helps you understand when and how your application is being attacked, and which rulesets are blocking such attacks. You can see samples of blocked requests with detailed information and you can also search a specific blocked request by ID.\n\n## Rollout\n\nMedusa Security is automatically enabled for all new projects.\n\nFor existing projects, only Medusa Instant Protection is automatically enabled. If you want to enable the other protections too, you can do it from the Security settings in your project. We strongly recommend you to do it, so your application security gets hardened right away. If you are worried about it blocking legitimate requests, you can enable it first on a preview or staging environment and see how it performs, and then enable it for production. You can always disable it if you notice too many false positives.\n\nIn a second phase, a few weeks from now, we will automatically enable all protections for all existing projects, and disabling it won't be possible. We will send a notification to the organization owner before doing so.\n\n## More is coming\n\nThis first release focuses on making applications safer by default. Medusa Security will continue to evolve with more advanced features in the coming months. Stay tuned.\n\n## Get started\n\nMedusa Security is available on Medusa Cloud today. Learn how to manage it in the [Medusa Security documentation](https://docs.medusajs.com/cloud/instant-protection).", "url": "https://wpnews.pro/news/announcing-medusa-security", "canonical_source": "https://medusajs.com/blog/announcing-medusa-security", "published_at": "2026-11-05 00:00:00+00:00", "updated_at": "2026-11-05 14:50:04.134532+00:00", "lang": "en", "topics": ["ai-agents"], "entities": ["Medusa", "Medusa Cloud", "Medusa Security", "Medusa Instant Protection", "NodeJS", "Pedro Guzmán"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/announcing-medusa-security", "markdown": "https://wpnews.pro/news/announcing-medusa-security.md", "text": "https://wpnews.pro/news/announcing-medusa-security.txt", "jsonld": "https://wpnews.pro/news/announcing-medusa-security.jsonld"}}