The Drupal project runs one of the most disciplined coordinated-disclosure programs in open source, and it has done so through volunteer effort for more than two decades. Millions of sites, many operated by governments, universities, and enterprises, depend on it.
This post is the first in a series stemming from the Drupal AI Security Initiative. Before I dive into how it's organized and what we've found, I wanted to share a post about how Drupal Security Team already works, because the initiative is built to supplement that foundation, not to repair or replace it. Note: this post assumes you are familiar with coordinated disclosure, CVEs, and severity scoring in general and focuses on what Drupal specifically does.
Coordinated disclosure, on a fixed cadence
Reports arrive in a private queue. A Security Team member takes triage duty on a two-week rotation, confirming whether a report is a real, in-scope vulnerability. Once validated, the affected project's maintainer and the original reporter collaborate in the confidential issue where the fix is written, reviewed, and scheduled. All of this stays out of public view until the fix and security advisory are ready on a release day.
Drupal has a predictable release cadence: advisories publish on Wednesdays, with a Public Service Announcement the Monday before on the very rare occasion a highly critical release warrants advance warning.
Scoring and identifiers
Every advisory carries a risk score using a system rating each issue 0–25 across six factors (access complexity, privilege required, confidentiality and integrity impact, exploit availability, and target distribution) mapped to labels from Not Critical to Highly Critical. Drupal's risk system was developed based on the NIST Common Misuse Scoring System. The project is now considering moving to CVSS, a more widely adopted standard. Drupal is also a CVE Numbering Authority, so it assigns its own CVEs: a level of formality most community projects don't reach. Summary data about the security track record is public with full details available as a series of posts or a JSON API with data going back to 2006.
What’s public and what stays private
The line between disclosure and discretion is drawn sharply. After release, advisories include all necessary details: affected project, severity, vulnerability type, affected versions, remediation, any possible mitigating factors, and CVE. Before release, the member disclosure policy permits a trusted insider to share only what is already public plus the bare numeric severity, never the affected project, the nature of the bug, or how to mitigate it. Members can't even let an employer market the fact that an employee had early knowledge.
Protection at the network layer
To protect site owners in the window between disclosure and patching, the Security Team and the Drupal Association offer Drupal Steward. Drupal Steward is a web application firewall (WAF) where Drupal Association engineers work with the engineers who wrote the security advisory to develop a rule that blocks the exploit at the request layer that goes live the moment the advisory does. This provides a virtual patch for highly critical, mass-exploitable bugs, but is not a replacement for patching.
The coverage model and its scope
Scope is defined just as clearly. Advisories cover Drupal core, plus contributed projects hosted on Drupal.org that opt into coverage (marked with a shield icon), and only for stable releases. Some things are deliberately out of scope: external libraries a module depends on and bugs requiring high-level administrative permissions. When a maintainer is unreachable, the team can mark a project unsupported.
By design the team is largely reactive: it responds to reports rather than continuously auditing Drupal core and tens of thousands of contributed modules. Members are asked for a few hours a month, a valuable contribution from highly skilled and in-demand individuals. The process is solid, but bandwidth has always been the primary bottleneck.
Scaling our response in the AI Era
Addressing that bottleneck is the whole point of this effort. It's also the founding premise of Alpha-Omega's Security Engineers in Residence program funding: that threat volume and pace are outrunning what volunteer hours can cover. AI has lowered the cost of finding and exploiting vulnerabilities. It enables high-volume report generation and can infer what a quietly worded commit was really fixing. A security process built around scarce attention and a modest head start now faces adversaries operating at machine speed.
Drupal’s security workflows are mature, documented, and trusted. The challenge now is scaling Drupal’s defensive bandwidth and throughput to match that offensive speed. That's what the Drupal AI Security Initiative adds, and it's the subject of the next post in this series.
If you'd like to help in the meantime, the most valuable things any contributor can do are what the team has always relied on: write secure code, report issues responsibly, and, if you have a track record in the community, consider joining the Security Team.
Tiffany Farriss authored this post and is responsible for its content. Members of the Drupal AI Security Initiative (Greg Knaddison, Tim Lehnen, and Drew Webber) and George DeMet contributed context, editing, and review. AI tools (Claude by Anthropic and Gemini by Google) assisted with research, organization, and editing. All facts were verified by humans against primary sources.
