siva01c Drupal Security Review Skill
Purpose
Use this skill to perform focused security reviews for Drupal 11 custom modules and themes.
When to apply
- Reviewing pull requests before merge.
- Auditing custom code for common web vulnerabilities.
- Preparing release readiness checks.
Review checklist
- Input handling: Validate and sanitize all external input.
- Output escaping: Escape output in Twig and PHP render logic.
- Database safety: Use query builder or placeholders in all SQL operations.
- Access control: Confirm route, entity, and operation permissions are enforced.
- Secrets and config: Ensure credentials are never committed and sensitive config is protected.
Common anti-patterns to flag
- Direct SQL string concatenation with user data.
- Unescaped raw markup in render arrays.
- Trusting
$_GET,$_POST, or request payloads without validation. - Debug leftovers (
var_dump,kint,dpm) in production paths.
Useful validation commands
rg "(var_dump|dpm\(|kint\()" web/modules/custom web/themes/custom
rg "\$_(GET|POST|REQUEST)" web/modules/custom web/themes/custom