Drupal contrib security review needs explicit access decisions, CSRF protection on state-changing routes, output checks and a repeatable release gate. This checklist focuses on those checks and the limits of grep-based searches.
Vault sprawl in multi-team CI/CD usually comes from weak governance, and another tool will not fix it. The model that works has four parts: short-lived identity-based access (OIDC/workload identity), path ownership boundaries, policy as code with review gates, and rotation and usage controls that each team can measure. If you change only one thing, replace stored CI tokens with OIDC and short-lived credentials.
Most build regressions get reported as "it feels slower", long after the commit that caused them. I built a small Node CLI that benchmarks next@16.1.6 builds under cold and warm cache, compares the result with a baseline, and writes JSON that CI can diff. A run is flagged when its mean build time rises past a threshold you set.
Most multi-agent failures are orchestration failures, and a smarter model does not repair a handoff that never said what done means. Before I tune any model, I would implement four controls: typed handoffs, explicit state contracts, step-level evals and transactional rollback. GitHub's engineering deep dive, published on February 24, shows the same core pattern.
I needed full Jira tickets in a form other scripts could read: the description, the comments and every attachment. The official API offers a token, a 5000-line JSON response and a separate authenticated call per attachment, and the SaaS alternative charges $20/month for what amounts to a curl command behind a dashboard. I built a Chrome extension that reads the ticket from the page I already have open.
Vibe coding an AI agent means you tweak a prompt, rerun it and ship when the output feels right. The feeling is the only check, and a feeling does not run in continuous integration (CI), the pipeline that tests every change. I build agents the way I build any other software: modular code, mocked dependencies (test stand-ins that return a fixed answer) and tests written before the logic.
The Wordfence blog feed lists vulnerable plugins, but it cannot tell a team whether its own sites run them. I built a WordPress plugin that adds wp wordfence-audit plugins and answers that question from the current feed. It is a triage step for teams that already read the feed. A full vulnerability database still covers what the feed never publishes.
Asking a Drupal site which PHP version it runs should not require an SSH key and a terminal. I built Project Context Connector, a Drupal module that exposes a read-only JSON snapshot of site configuration to AI agents, automation scripts and monitoring tools. Each tool reads the same snapshot through one of four interfaces: REST, an HMAC-signed endpoint (a request signed with a shared secret), Drush or native Model Context Protocol (MCP) support.
AI made finding vulnerabilities cheaper, but it did not make fixing them cheaper. The cost lands on an open-source maintainer with limited hours, who now has to sort a flood of security reports into urgent, false positive and later. Drupal AI Vulnerability Guardian works on that sorting step: it scans Drupal modules for 12 vulnerability patterns and gives each finding a score, a CWE ID and an estimate of the work to fix it.
Version one of Drupal AI Content Impact Analyzer returned one opaque number, which told editors how a page scored and nothing about why. It was a minimal proof of concept with a single scoring function, no tests and no documentation worth mentioning, so it proved the idea worked but not that editors could use it. Version two rewrites the core into a scoring engine with six dimensions, and each one tells the editor what to fix.
A scanner that only reports broken entity references hands you a well-formatted list of manual work. The first version of drupal-entity-reference-integrity did exactly that. This upgrade adds an opt-in auto-fix mode, batch processing for large sites and the tests needed to trust both in production.
The first version of this Drupal agent could create, read and list nodes. That proved the concept, but it could not fix a typo in the content it had created. A content operations agent also needs update, delete, users, taxonomy and media, and it has to survive a flaky network, so retry logic now lives once in the HTTP client.
A skill from a public marketplace arrives with code, setup instructions and a download count. The download count is no evidence of safety. I built Skills Sentry, a static scanner that reads a skill bundle without running it and scores its risk before the bundle touches my machine.