This document covers the drupal-cve-2026-9082-scanner tool itself, not the Drupal vulnerability it detects.

If you discover a security issue in this scanner (e.g., command injection via crafted server responses, information leakage, unsafe temp file handling), please report it responsibly.

Do NOT open a public issue.

Instead, send an email to: strobelpierre@gmail.com

Include:

1. Description of the vulnerability
2. Steps to reproduce
3. Potential impact
4. Suggested fix (if any)

• Acknowledgment: within 48 hours
• Assessment: within 7 days
• Fix release: within 30 days for confirmed issues

This scanner is designed to be safe by default:

• No SQL payloads are sent to target systems
• No state-changing requests (POST, PUT, DELETE) are made
• No credentials are stored or transmitted
• Temporary files are created in a private mktemp -d directory and cleaned up on exit via trap
• The scanner does not follow redirects to external domains beyond the target

• Server responses are parsed with grep — a malicious server could craft responses to cause false positives, but cannot achieve code execution through this path
• The --json output constructs JSON manually; field values are constrained to known formats (URLs, version strings, booleans, integers)