Features
Not a generic scanner with a Drupal label stuck on it. Thirty-two features, each built around how Drupal advisories, modules, and configuration actually work.
01 · Security matching
Drubix polls Drupal.org's security advisory feed continuously and cross-references it against each site's actual installed modules. The PHP libraries a site pulls in through Composer (Symfony, Guzzle, Twig and the rest) are checked too, against the Packagist advisory database. Once the connector module or GitHub is connected, this is a confirmed version match, not a guess based on what's publicly exposed.
$ checking 34 modules against 1,842 advisories
HIGHWebform: SA-CONTRIB-2026-014
Installed: 6.2.1 · Fixed: 6.2.3
02 · Multi-site dashboard
See every site in one place, sorted by what actually needs attention, not fifty separate admin logins to check one at a time. Each site shows its open findings, last scan time, and whether the connector module is reporting confirmed data.
03 · AI-opened fix pull requests
"Module X is vulnerable" is table stakes. For a confirmed finding, Drubix opens a real pull request against your repo with the exact Composer version bump, already committed on a branch, ready to review and merge. The updated composer.lock is committed on the same branch, so your CI tests exactly what will be installed. The fix itself is never AI-guessed: it's the version the security advisory actually specifies. AI only writes the plain-English explanation in the PR description. When one advisory affects several of your sites, open a PR on every one of them in a single click. With Autopilot on, patch-level fixes are merged for you once CI passes.
HIGHWebform XSS (SA-CONTRIB-2026-014)
-> PR #42 opened on github.com/you/your-site
04 · Real-time alerts
A weekly PDF nobody reads isn't a monitoring tool. When a new advisory affects a site you manage, Drubix pushes an alert to Slack, Microsoft Teams, Discord, email or a webhook immediately, filtered by the severity threshold you set, so you're not paged for every low-priority finding. Every alert has one-click Acknowledge and Snooze links, and new advisories are matched against your sites within the hour.
composer require drupal/webform:^6.2.305 · White-label reports
Every month, each client gets a report from you, not from us: your logo, colour and name, with replies coming to your inbox. A short email plus a branded PDF show what was checked, what was fixed, what's still open, the health score trend and uptime. Pick the send day, add a personal note, or send one now.
06 · Historical trends
A point-in-time scan tells you today's status. Drubix records a daily snapshot of open findings by severity, so you can show a client (or yourself) whether a site's health is actually improving over time, not just what it looks like right now.
07 · Cross-site benchmarking
Once enough sites are being monitored, see how any given site's security posture ranks against every other Drupal site on the platform. Not just whether it's improved since last month, but how it compares more broadly. Requires a minimum sample size before showing a number, rather than a misleading percentile from a handful of sites.
of monitored Drupal sites for open critical findings
08 · Config drift detection
Config changed directly on a live site but never exported to your repository is a classic source of "it worked on staging" surprises. The connector module compares active configuration against the last exported config and flags exactly which objects have drifted.
09 · CI/CD integration
Gate a deploy pipeline on open findings. Fail the build automatically if a known vulnerability is present, before it ever reaches production. Drops straight into GitHub Actions or any CI system that can run a script.
# .github/workflows/monitor-gate.yml
Fetched 1 open finding(s) for site.
[high] Webform: SA-CONTRIB-2026-014
Build gate FAILED: severity ≥ high found.
10 · Attack surface scanning
Checks for a publicly reachable .git/ directory, .env file, or database backup left in the webroot, and audits standard security headers (HSTS, CSP, X-Frame-Options). No connector needed; this runs on every passive scan.
CRITICALPublicly exposed: /.git/config
A readable .git directory can expose your entire commit history.
MODERATEMissing security header: content-security-policy
11 · Permissions, settings & admin audit
Flags the anonymous or authenticated role holding a permission dangerous enough to hand over site control, such as "administer permissions" or "execute PHP code", plus writable settings.php and a missing files .htaccess. It also reviews the settings attackers look for (trusted host patterns, PHP errors shown to visitors, Twig debug on production, development modules left enabled, risky upload extensions, unsafe text formats) and audits administrator accounts: new admins, dormant ones, a user literally called "admin", and admins without two-factor login. No generic scanner can check this; it requires understanding Drupal's role model specifically.
12 · Unmaintained module flagging
Most contrib modules aren't covered by Drupal.org's security advisory policy at all. Drubix flags known-unmaintained or inherently risky modules, like the deprecated PHP filter, proactively, rather than only reacting once an advisory eventually gets published.
13 · Blast-radius incidents
When an advisory hits many sites in your portfolio at once, Drubix groups it into a single incident instead of forcing you to click through fifteen separate findings one at a time. Only possible because the platform is multi-site-aware. No single-site tool can do this by definition.
14 · Mean time to patch
Computed automatically from data Drubix already has: the average days between a finding being detected and resolved. "We patch in an average of 3.2 days" is a concrete, retainer-justifying claim, not a vague promise.
average time to patch, last 90 days
15 · Known-exploited prioritization
Cross-references matched advisories against CISA's Known Exploited Vulnerabilities catalog, reordering "fix this first" by real-world attacker activity, not just a severity label. A moderate finding that's actively being exploited jumps ahead of a critical one that isn't.
HIGHWebform: SA-CONTRIB-2026-014
16 · AI agent activity correlation
Drupal's own AI agents can now create fields, content types, and other configuration from natural-language instructions, with no developer in the loop. Drubix correlates that activity against real configuration drift and permission checks, so you find out when an autonomous change is worth a second look, not just when someone reviews it by chance. Every finding says plainly when it's a correlation, not proof. It flags what's worth checking, it doesn't claim certainty it doesn't have.
AIAgent activity + permission grant
17 · Plain-English report summaries
Every PDF report opens with a short, accurate paragraph: real severity counts, the actual most urgent issue, written in plain language for a non-technical client. The facts are always real and already computed; AI only handles the sentence, never the judgment.
"This report found 9 open findings (2 critical, 3 moderate...). The most urgent issue is: publicly exposed /.git/config."
18 · Upgrade planner
For each site, Drubix shows whether its core version and PHP version still get security fixes, and checks every contrib module against drupal.org for the next major version: ready, update to a specific release, pre-release only, or blocking. You get an ordered upgrade plan per site instead of a spreadsheet of guesses.
EOLDrupal 10.4 · security support ends 9 Dec 2026
PHP 8.1 → Drupal 11 needs PHP 8.3+
31 of 34 modules ready for Drupal 11
19 · Uptime, SSL & domain monitoring
Every monitored site is checked every 5 minutes. A site counts as down after two failed checks in a row, so one blip doesn't page anyone, and you get a “back up” alert with the outage length. Daily checks warn you before an SSL certificate or a domain registration expires, and flag broken certificate chains. Everything goes through the same alert channels as security findings.
20 · Client health page
Give each client a read-only page in your branding: health score, open items by severity, a 90-day trend, what was fixed recently and uptime. No login, never indexed by search engines, and open-issue details stay hidden unless you choose to show them. Replace or turn off the link whenever you like.
21 · Team workflow
Acknowledge, snooze, accept a risk with a written reason, or assign an issue to a teammate, who gets an email with the fix. Snoozed and accepted issues drop out of digests and escalations; everything is kept in a per-issue history. Actively exploited vulnerabilities can't be snoozed. Every alert has one-click Acknowledge and Snooze links, so triage happens straight from Slack or email.
22 · Daily digest & escalation
Each morning, in your timezone: new critical and high issues, criticals still open and what was fixed. It's skipped on quiet days and replaced by a short all-clear on Mondays. If a critical issue stays unpatched for the number of days you choose, it escalates to the account owner and anyone else you add. On the 1st of each month you get a summary of everything Drubix caught, fixed and prevented.
Daily digest · Thursday 24 September
NEW1 critical · 2 high
Fixed since yesterday: 3
Overdue: Webform RCE (4 days open)
23 · Exact versions from composer.lock
Connect the site's GitHub repository and Drubix reads composer.lock on every scan, so every finding is a confirmed version match even without the connector module. Advisory data comes straight from packages.drupal.org with exact affected-version ranges, and the suggested fix is the right release for the branch each site is on.
$ reading composer.lock · 64 Drupal packages
webform 6.2.5 · affected: <6.2.12 || >=6.3.0 <6.3.1
24 · Bulk import & bulk fixes
Import sites from a CSV, a Pantheon account or an Acquia Cloud account, including each client's report recipients, with a preview before anything is added. When one advisory hits fifteen of your sites, open fifteen fix pull requests with one click, each with the right version for that site.
25 · Autopilot
Turn it on per site and Drubix handles the routine patches end to end. It opens the fix PR, updates composer.lock, waits for your CI, and merges only the exact commit your tests passed. It only takes patch-level updates like 10.3.5 to 10.3.6. Anything bigger, or anything that looks wrong (a failing test, a Composer conflict, a declined approval), stops it, leaves a comment on the PR and alerts you. If you'd rather the client signs off first, they get an approve or decline link sent in your agency's name. Drubix never deploys: your release process stays in charge.
HIGHWebform: access bypass · 6.2.7 to 6.2.9
PR #42 opened · composer.lock updated
CI passed · client approved
26 · Before & after screenshots
Point Drubix at your PR previews or staging site and, once CI passes, it screenshots the homepage and key pages like login, checkout and contact on both the live site and the preview. Error pages are caught straight away, and pages that look very different are held for a human to check. The screenshots sit next to the PR, and go to the client with the approval request, so everyone can trust a patch enough to merge it quickly.
27 · Temporary firewall rules
Code freeze, client sign-off, a big upgrade in progress: sometimes the patch has to wait. For a vulnerable contrib module, Drubix reads the module's routes from the exact release the site runs and gives you a rule that blocks its public URLs, ready to paste into Cloudflare, Nginx or Apache. Admin pages and ordinary Drupal pages are never touched. It's a stopgap until the update ships, and the docs say plainly what it does and doesn't cover.
28 · Custom code scanning
Most agency sites carry custom modules and themes that no security advisory will ever cover. Drubix scans them in the connected repository for the mistakes that cause real Drupal breaches: SQL built by joining strings, user input printed as markup, unserialize() on request data, shell commands, eval(), Twig's |raw filter, routes open to anyone, and more. Contrib, core and vendor code are skipped, and a comment silences a line you've reviewed.
HIGHSQL built from user input
modules/custom/client_search/src/SearchController.php:48
29 · Secrets in the repository
Database passwords in settings.php, API keys in a .env file, private keys, cloud and payment credentials, even database dumps: Drubix checks the site's repository for them every day and tells you which file and line. It never stores the secret itself, only its location and the first few characters, so you can find it and rotate it.
CRITICALDatabase password in the repository
web/sites/default/settings.php:812 · "Real…0!" (13 characters)
30 · File integrity monitoring
Once a day the connector compares every core and contrib code file on the server with the official Drupal.org release it claims to be. You hear about modified files, files that shouldn't be there at all, and, most urgently, PHP files sitting in the public files folder, where a web shell usually hides after a break-in. Patches you applied on purpose are easy to tell apart from tampering.
31 · Page tampering monitor
Every day Drubix opens the homepage and key pages (login, checkout, contact) in a real browser and records every script, frame and form destination. A new third-party script, a form that suddenly posts somewhere else, a card skimmer, a crypto-miner, hidden spam links, or a redirect that only fires for visitors arriving from Google: each one raises an alert. Accept a new source your team added and it won't alert again.
CRITICALPossible card-skimming script on /checkout
HIGHNew third-party script source: cdn-stats.example.net
HIGHVisitors from Google are redirected away
32 · Email & DNS security
Daily checks of each site's domain for missing or weak SPF, DKIM and DMARC records, so nobody can send convincing phishing in your client's name. Drubix also looks up the domain's subdomains in public certificate logs and flags ones still pointing at a deleted service (an old Heroku app, a removed S3 bucket, a closed Azure site), the dangling records attackers take over to host content on your client's domain.
Start with a free scan. No credit card, no commitment.