Traditional coding standards emphasize formatting and maintainability. A security-focused PHPCS standard looks for suspicious PHP patterns such as unsafe input handling, risky output, or dangerous functions.

php-security-audit:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v7
    - uses: shivammathur/setup-php@v2
      with:
        php-version: "8.3"
        tools: composer:v2
        coverage: none
    - run: composer install --no-interaction --prefer-dist --no-progress
    - name: Report PHP security findings
      continue-on-error: true
      run: >-
        vendor/bin/phpcs --standard=Security
        --extensions=php,module,inc,include,install,test,profile,theme
        --ignore='*/node_modules/*,*/vendor/*'
        docroot/modules/custom docroot/themes/custom

The extensions cover Drupal-specific PHP files. Excluding vendor and node_modules keeps the scan focused on code the team owns.

A warning is a prompt for review, not proof of an exploitable vulnerability. Confirm the data source, trust boundary, sanitization, output context, and permissions. Drupal framework APIs may be safe even when a generic sniff lacks enough context to recognize them.

Triage the initial findings, fix real risks, and document narrow exclusions for false positives. Once the baseline is clean, remove continue-on-error so new findings block merging.