Show Notes
Today we are talking about Security, Vulnerabilities, and how to avoid exposure with guest Dave Welch. We'll also cover Security Scanner as our module of the week. For show notes visit: https://www.talkingDrupal.com/567 Topics What Are CVEs CVE Lifecycle and Disclosure AI Era Security Challenges What CVE Program Excludes Patch Fast Reality Global Security Signals CVE Timing Judgment KEV Flags Explained CVE Updates Link Rot Who Decides CVE Sneaky Patch Dangers ADP Program Fixes Small Team Triage Vulnerability Tsunami AI Autonomous Security Future Legal Pressure Budgets Resources Psalm PHP Static Analysis Tool SARIF format PHP ecosystem Council of roots How AI Broke Open Source Security: End-of-Life Software Is the Most Exposed CVE podcast Vulncon PSIRT Guests David Welch - github: dwelch2344 dwelch2344 Hosts Nic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi JD Flynn - dorficus MOTW Correspondent Martin Anderson-Clutz - mandclu.com mandclu Brief description: Have you ever wanted a fast way to catch the security mistakes that slip into custom Drupal code — especially the code your AI assistant just wrote — before it ships? There's a module for that.
Module name/project name: Security Scanner
Brief history How old: created in July 2026 by Mayank Gupta (mayankguptadotcom) of Acquia Versions available: 1.0.0, which works with Drupal 10.3 and 11
Maintainership Actively maintained — created and shipped its first stable this summer, with steady development right through late July Security coverage Test coverage — and it's strong: unit and kernel tests, including a regression corpus built from real Drupal core advisories Documentation? In-depth README with a full check table and CI recipes, plus a CHANGELOG Number of open issues: 1 issue, not a bug
Usage stats: 2 sites (it's brand new)
Module features and usage Provide a Drush command, has no UI — you point drush security:scan at a module or any path, it reads the code statically, and prints a prioritized, OWASP-mapped list of things to review It's built for the age of AI-written code — the checks target the classes AI assistants keep reintroducing: routes with no access check, #markup and |raw XSS, missing CSRF tokens, unserialize() on untrusted data, hardcoded secrets Then there's an optional deep pass: with the Psalm static analysis scanning engine installed, it'll trace untrusted input across functions and files to catch cross-function issues. And it's honest about state — the report always says whether that deep pass ran, was skipped, or failed, so a failure never gets mistaken for a clean scan One nice detail under the hood: a tokenizer-backed "code map" that knows whether a match is real code, a comment, or a string — so it won't flag the word "unserialize" sitting in a doc comment. That kills the single biggest source of false positives The checks are regression-tested against real Drupal advisories (Drupalgeddon, Drupalgeddon2, the 2019 unserialize bug, etc) so a pattern that caused an actual CVE can't quietly come back in your custom code Output comes in three flavors: a readable table, JSON for CI and AI agents, and SARIF — which means findings show up as annotations right on your GitHub or GitLab merge-request diff instead of buried in a job log For adopting it on an existing codebase there's a baseline file — you fingerprint the findings you've reviewed, with a required reason on each, and they stop failing the build but never go invisible; every run still counts them It exits non-zero on error-level findings, so it drops straight into CI or a pre-commit hook And it's extensible — checks are Drupal plugins with a #[SecurityCheck] attribute, so any module can add its own or alter the ones that ship Big caveat, and the module says this itself: a finding means "review this," not "this is broken." Static analysis has false positives, and a clean scan doesn't prove the code is secure —
More from Talking Drupal
Today we are talking about Drupal Advocacy, Non-Code Contribution, and the future with guest Tiffany Farriss. We'll also cover Better Social Sharing Buttons as our module of the week. For show notes visit: https://www.talkingDrupal.com/575 Topics Tiffany New DA Role Sustaining Drupal Next 25 Time Box And Priorities Three Bucket Strategy Fixing DA Finances Transparency And Trust Trust Through Transparency What Advocacy Solves Why Reputation Lags From Scattered To Focused Beyond The Drupal Bubble Problem First Storytelling Proof Over Promotion Scaling Non Code Contributions Funding Drupal Sustainability Success Metrics Resources Drupal Advocacy Program Guests Tiffany Farriss - association.drupal.org farriss Hosts Nic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi Tim Sharp - tea-sharp MOTW Correspondent Martin Anderson-Clutz - mandclu.com mandclu Brief description: Have you ever wanted to let visitors share your content on social media, without loading any tracking scripts or third-party JavaScript? There's a module for that.
Today we are talking about the UN, Open Source, and Drupal with guests Tim Lehnen & Henry Poole. We'll also cover Live Update as our module of the week. For show notes visit: https://www.talkingDrupal.com/574 Topics What Is UN Open Source Week Why Open Source Fits UN Goals Who Attends and What Tech Is There Conference Audience and DPI DPG Drupal as a Digital Public Good UN Uses Drupal at Scale Why Attend and What to Gain Upstream First Contracting Open Procurement Curriculum Reaching Procurement Conferences Steering Spend Upstream Funding Open Source Legally Talking Louder Beyond Drupal Digital Sovereignty Explained Governance Values Matter Fixing Funding Perception Community Next Steps Closing Resources Appalachia Omar Mohsine Digital public infrastructure - DPI Digital public good - DPG ShareIT act Agencies need to use open source PDF: https://www.govinfo.gov/content/pkg/COMPS-17951/pdf/COMPS-17951.pdf
Today we are talking about Drupalcon Rotterdam, Canvas and evaluating modules. We'll also cover Revision Graph as our module of the week. For show notes visit: https://www.talkingDrupal.com/573 Topics DrupalCon Rotterdam recap AI summits and training FrankenPHP app servers Driesnote highlights Advocacy and WordPress Rosetta Sprint and MCP Canvas multilingual and headless 3Frameworks And Voiceover Canvas And SDCs Headless And Signage Drupal 12 Beta Testing Rector And Deprecations PHP 8.5 Requirements Rethinking Module Evaluation AI And Commit Scale Module Discoverability 0Distributions Versus Recipes Resources Wordpal Core metrics Hosts Nic Laflin - nLighteneddevelopment.com nicxvan Martin Anderson-Clutz - mandclu.com mandclu Tim Sharp - tea-sharp MOTW Correspondent Martin Anderson-Clutz - mandclu.com mandclu Brief description: Have you ever wanted to see a node's revision history drawn like a Git graph, with each translation as its own branch? There's a module for that.
Today we are talking about PHP, Open Source, and Sustainability with guest Elizabeth Barron. We'll also cover AI Image Classification as our module of the week. For show notes visit: https://www.talkingDrupal.com/572 Topics What is the PHP Foundation Language Health Challenges Paid Core Developers Release Infrastructure Foundation Role and Perception Docs and Onboarding Elizabeth Open Source Journey Future of PHP Ecosystem Listener Elephant Question Ecosystem Security Hub Advisory Board Limits Modernizing Mailing Lists Foundation Awareness Push PHP Ambassadors Strategy State of PHP Survey Five Year Vision Community Hour Podcast php.net Design Refresh Resources The PHP Foundation Derek Rethans xdebug Infrastructure https://github.com/derickr
Today we are talking about GovHub, Drupal in Government, and Why Governments Love Drupal with guest Jasmyne Epps. We'll also cover Convivial Gov Site Template as our module of the week. For show notes visit: https://www.talkingDrupal.com/571 Topics GovHub Origins and Goals Feature Requests and Governance Why Government Chooses Drupal Team Structure and Release Cadence Accessibility and Compliance Strategy Hosting Model and Multisite Structured Content and Microcontent Syndication and Emergency Alerts Orchard Design System Explained Training and Onboarding Editors Gov Talks Conference Logo Specs and Releases Ticket Prioritization PRICE QA Workflow with Tugboat Handling Traffic Spikes Drupal 11 Performance Talk Drupal 11 Upgrade Gotchas Getting Users Excited Translation Strategy Limits Why Government Loves Drupal Resources GovHub The Bug Stops Here — The State of Georgia Shifts Left (GovCon 2025 presentation with Jasmyne Epps and James Sansbury) Accelerating an ambitious migration and development project (GovHub + Tugboat migration story) Logo page Public facing knowledge base Orchard design system (P)Rice (P)olitics - (R)each - (I)mpact - (C)onfidence - (E)ffort