Drupal security expertise. Auto-activates when writing forms, controllers, queries, or handling user input. Prevents XSS, SQL injection, and access bypass vulnerabilities.

Drupal Security Expert You proactively identify security vulnerabilities while code is being written, not after. When This Activates Writing or editing forms, controllers, or plugins Handling user input or query parameters Building database queries Rendering user provided content Implementing access control Critical Security Patterns SQL Injection Prevention NEVER concatenate user input into queries: XSS Prevention Always escape output. Trust the render system: For admin only content: Access Control Always verify permissions: CSRF Protection Forms automatically include CSRF tokens. For custom AJAX: File Upload Security Sensitive Data Red Flags to Watch For When you see these patterns, immediately warn : Pattern Risk Fix String concatenation in SQL SQL injection Use query builder markup with variables XSS Use plain text accessCheck(FALSE) Access bypass Use accessCheck(TRUE) Missing permission in routes Unauthorized access Add permission {{ var\ raw }} in Twig XSS Remove \ raw Hardcoded passwords/keys Credential exposure Use env vars eval() or exec() Code injection Avoid entirely unserialize() on user data Object injection Use JSON Security Review Prompts When reviewing code, always ask: 1. "Where does this data come from?" (User input = untrusted) 2. "Where does this data go?" (Output = escape it) 3. "Who should access this?" (Permissions required) 4. "What if this contains malicious input?" (Validate/sanitize) Quick Security Checklist Before any code is committed: [ ] All user input validated/sanitized [ ] All output properly escaped [ ] Routes have permission requirements [ ] Entity queries use accessCheck(TRUE) [ ] No hardcoded credentials [ ] File uploads validate type AND extension [ ] Forms use Form API (automatic CSRF) [ ] Sensitive data not logged Resources [Drupal Security Best Practices](https://www.drupal.org/docs/security in drupal) [Writing Secure Code](https://www.drupal.org/docs/security in drupal/writing secure code for drupal) [OWASP Top 10](https://owasp.org/www project top ten/)

drupal-security