Security considerations

Plugins extend the gateway, but each plugin is also code that runs on the data plane. Before enabling a plugin in production, review the risks and constraints in this guide.

Before you enable a plugin

1. Confirm the plugin is supported for your product. Each plugin card shows whether it runs on APISIX, API7 Gateway, or both. Do not assume an APISIX plugin works unchanged on API7 Gateway, or vice versa.
2. Read the full plugin page. The Plugin Hub page for each plugin lists the configuration schema, fields, and any product-specific notes.
3. Check the release and version matrix. Some plugins require a minimum gateway version. See Plugin Common Configurations (opens in Apache APISIX docs) for shared configuration patterns.

Credential and secret handling

• Never store private keys, API tokens, or database credentials in plain text in plugin configuration.
• For authentication plugins such as Basic Auth, JWT Auth, and Key Auth, follow the product's secret-management workflow. API7 Gateway uses secure credentials (opens in API7 Gateway docs) and consumers and credentials (opens in API7 Gateway docs).
• For plugins that call external services, such as AI Proxy or OpenID Connect, verify the endpoint uses TLS and that certificates are valid.

Network and data handling

• Do not expose the admin API to the internet. Plugins that interact with the Admin API should only run on a trusted control-plane path.
• Limit plugin execution to the routes that need it. Unused plugins add attack surface and latency.
• Review logging plugins before enabling them in regulated environments. Plugins such as HTTP Logger, Kafka Logger, and Splunk HEC Logging may carry request bodies or headers.
• Be cautious with request/response transformation plugins such as Proxy Rewrite, Response Rewrite, and Body Transformer. They can alter headers or bodies in ways that bypass downstream validation.

AI plugin risks

• AI plugins may send request data to third-party providers. Review each provider's data policy before enabling plugins like AI Proxy, AI RAG, or AI Request Rewrite.
• Use guardrail plugins such as AI Prompt Guard, AI Lakera Guard, or AI Aliyun Content Moderation to filter inputs and outputs.

Testing and rollback

• Test plugin changes in a non-production route or gateway group.
• Capture the previous configuration before applying changes so you can roll back quickly.
• Monitor error rates and latency after enabling a new plugin. See API7 Gateway observability overview (opens in API7 Gateway docs) or APISIX observability runbook (opens in Apache APISIX docs).

Reporting issues

If you believe a plugin has a security issue, report it through the appropriate channel for your product and do not share exploit details in public channels until a fix is available.