Good Extension, Bad Extension: How To Tell The Difference Before It's Too Late

Slide deck from Meet Magento Netherlands, 6th November 2025

Transcript

1. Good Extension, Bad Extension www.athoscommerce.com How to tell the difference before itʼs too late
2. 2 Hi, I’m Abi Development lead at multiple award-winning ecommerce agencies years agency Transitioned international clicks-and-mortar fashion retailer to in-house development Led migration to Magento 2 Lead software engineer responsible for platform integrations at AI Search and Personalisation provider years in-house years vendor side 7 3 5
3. 3 Lessons from the Trenches 1. Most people donʼt care about bad code
4. 4 Lessons from the Trenches 1. Most people donʼt care about bad code 2. A lot of bad code does what it claims
5. 5 Lessons from the Trenches 1. Most people donʼt care about bad code 2. A lot of bad code does what it claims 3. Bad code presents tangible risks
6. 6 Lessons from the Trenches 1. Most people donʼt care about bad code 2. A lot of bad code does what it claims 3. Bad code presents tangible risks 4. Stakeholders can be quick to point the finger and slow to make connections
7. 7 Lessons from the Trenches 1. Most people donʼt care about bad code 2. A lot of bad code does what it claims 3. Bad code presents tangible risks 4. Stakeholders can be quick to point the finger and slow to make connections 5. People are stubborn
8. 8 Good Extension, Bad Extension
9. 9 Good Extension, Bad Extension Performant & feature-rich Lower quality with security concerns
10. 10 Outline the Process Align Expectations Be Transparent Get Buy-In 1 Step Zero: Expectation Management 2 3 4
11. 11 Audit Process • Automated checks • Functional testing • Manual investigation Information Gathering 1 • Write up findings • Make recommendations Report 2 • Stakeholder discussions • Move forwards Sign-Off 3
12. 12 Information Gathering • phpcs with Magento coding standards / Slevomat Run with and without –ignore-annotations • phpmd • Custom regex and code parsing Code Quality Pro-Tip • phpstan with Bitexpertʼs phpstan-magento • Psalm • SonarQube with magento2php plugin • Exakat Static Analysis • Composer Dependency Audit • phpcs Security Audit • phpmf Security
13. 13 Transparency Matters • Encryption • Obfuscation • Offloaded Functionality
14. 14 What does a good extension look like? Quality Extensibility Performance Security Is the code clean, SOLID, and follows Magento conventions? Is the codebase easy to extend, integrate, and maintain? Is it scalable, efficient, and optimised for real-world traffic? Can we trust it to protect data, users, and our reputation?
15. 15 Common Red Flags Problem ObjectManager used to create dependencies on the fly Why itʼs an issue • Breaks Dependency Inversion • Forces global preferences • Prevents test mocks How do we catch it? Grep for “ObjectManager::getInstanceˮ
16. 16 Common Red Flags Problem Preferences for core classes Why itʼs an issue • Violates Open/Closed Principle • Causes conflicts with other extensions How do we catch it? Grep di.xml for out-of-scope preferences
17. 17 Common Red Flags Problem God Classes and misplaced business logic Why itʼs an issue • Violates Single Responsibility and Interface Segregation • Prevents code reuse • Signal that developers are still following old patterns How do we catch it? Watch for long methods and high cyclomatic complexity Grep for “Helperˮ classes
18. 18 Common Red Flags Problem Deprecated and discouraged code Why itʼs an issue • Bypasses critical core logic • Potential security issues • Suggests missing standards and lax review process How do we catch it? Grep for deprecated method calls and review Check phpcs report for discouraged function calls
19. 19 Architecture • Is the structure clear and predictable? • Metapackage or monolith? • Are dependencies appropriate? • Can modules be removed or replaced independently?
20. 20 Code Style • Is there a clear and consistent voice throughout? • Is it easily grokable when debugging? • Does it feel “generativeˮ?
21. 21 Extensibility Remember to consider compatibility with future roadmap items • Are they fired in appropriate places? • Do they send usable context data? Events • Is key functionality hidden in private methods? • Are method arguments passed by reference? Plugins • Are classes composable? • Are concretions used instead of interfaces? Composability
22. 22 Performance Data Access Thread Blocking Cache Abuse • Load / Save in the loop? • Excessive attribute joins • Long-running processes in controllers • Observers on high-frequency or critical events • Aggressive cron schedules in the default group • Render-blocking JavaScript includes • Unnecessary or overly broad cache invalidation • Disabling FPC • Overuse of private Graphql content Database • Appropriate datatypes? • Missing indexes for large queries Architecture • Around plugins • Ignoring proxy classes
23. 23 Security • Unescaped SQL • Inadequate server-side input validation • Missing CSRF tokens Escaping and Validation • Missing or overly broad? • Applied to all areas appropriately? Access Control • Are endpoints secure and authenticated? • Is sensitive data included in request? Outbound Requests Don’t forget to inspect request headers
24. 24 Functional Testing • Dedicate time to QA • Pay attention to features stakeholders need • Ensure everything plays nicely together • Watch for performance bottlenecks • Donʼt ignore frontend concerns Blackfire, New Relic, XHProf, Magento profiler Varnish, Dev Tools, Lighthouse Use a representative environment & keep backups ready!
25. 25 Vendor Assessment Treat vendors as part of your development team
26. 26 Vendor Assessment • Established company or one-man-band? • How active are they? • Backwards compatibility • Response to new versions and new technologies? • Is there a public roadmap? Reliability and Track Record Support Documentation • How responsive and knowledgeable are they? • Will they help debug conflicts and custom code? • Is their first response to ask for SSH access? • Do they have clear SLAs? • How comprehensive and up-to-date is it? • Does it cover user and technical docs? • Is it clear and easy to follow? • Are changelogs transparent?
27. 27 Moving from data to a decision
28. 28 Making a Decision • Is it really irredeemable? • Do any preferred vendors provide something equivalent? • May not be viable for integration with third party services Find an Alternative Roll Your Own Install and Extend • Can you honestly do better, in a time-effective way? • You are now responsible for maintenance • Could you resell to other clients? • Often the best compromise for stakeholder buy-in • Is the module extensible enough to support this? • Can cause issues with vendor support • Good option for third party service integrations
29. 29 A moment of introspection Is this the right recommendation for this situation? And how can I validate that?
30. 30 Talking to Stakeholders development. Speak their language Quantify Bring options Pick your battles
31. 31 Talking to Stakeholders Speak their language Quantify Bring options Pick your battles • Operational stability and day-to-day running Ecommerce Manager • Delivery risk and timelines Product Owners and Project Managers • Long-term value and impact of cutting corners SME Agency Client • Brand risk, business alignment, and impact on KPIs Enterprise Clients
32. 32 “Just Install It” Never ignore genuine security concerns Escalate to Security
33. 33 “Just Install It” Never ignore genuine security concerns Escalate to Security Walk Away Nuclear option if you can afford to lose the relationship
34. 34 “Just Install It” Never ignore genuine security concerns Escalate to Security Walk Away Compromise Nuclear option if you can afford to lose the relationship Bring options and find a middle ground
35. 35 “Just Install It” Never ignore genuine security concerns Escalate to Security Walk Away Compromise Nuclear option if you can afford to lose the relationship Bring options and find a middle ground Ensure any risks are documented before moving forwards Disagree but Commit
36. 36 “Just Install It” Never ignore genuine security concerns Escalate to Security Walk Away Compromise Nuclear option if you can afford to lose the relationship Bring options and find a middle ground Ensure any risks are documented before moving forwards Disagree but Commit Let It Go Save yourself for issues that matter more
37. 37 A Word To Vendors Embrace transparency and feedback: More eyes on your code means a better product
38. 38 A Word To Vendors • Care about your code • Respect backward compatibility • Build strong partner relationships • Listen to your users • Write. Good. Documentation • Know your worth
39. 39 Invest in your audit process Understand the code, and the people behind it Validate your approach Be pragmatic and base decisions on evidence, not ego Speak your stakeholdersʼ language Honesty and clarity build trust - technobabble doesnʼt! In Summary
40. 40 Finally: hold vendors - and yourselves - accountable Invest in your audit process Understand the code, and the people behind it Validate your approach Be pragmatic and base decisions on evidence, not ego Speak your stakeholdersʼ language Honesty and clarity build trust - technobabble doesnʼt! In Summary
41. Thank You! Any Questions? www.athoscommerce.com Abi Green Lead Software Engineer @abiverde @abi-klevu Slides and follow-up articles @ abiver.de