Docs / Getting started
Go to app.drubix.com/signup and create an account with your agency name, email, and a password (at least 10 characters). This creates your agency and logs you in — no credit card needed at this step.
From the dashboard, paste a URL into "Add a site to monitor." Drubix immediately runs a passive scan — no credentials required — and reports back what it found: detected Drupal core version, contrib module names, and any immediate findings.
The free plan allows up to 2 monitored sites. Beyond that, a paid plan is required — see pricing.
A passive scan works from what any anonymous visitor could see: response headers, asset paths that reveal contrib module names, and (when reachable) CHANGELOG.txt for a confirmed core version. It does not see:
All of the above require installing the connector module on the site — see the connector module guide.
Each finding shows a severity (critical/high/moderate/low/info), a description, and — where applicable — a remediation command ready to run (e.g. composer require drupal/webform:^6.2.3). An "info" severity means the module was detected but its version couldn't be confirmed passively; it's a prompt to install the connector, not a confirmed vulnerability.
Configure a Slack webhook or email address to be notified when a new advisory affects a site you manage, filtered by the severity threshold you choose — rather than needing to check the dashboard manually.