Drupal 10/11 Contrib Security Pitfalls: A Hardening Checklist for Maintainers

If you maintain a Drupal 10/11 contrib module, the biggest security misses are still predictable: missing access checks, weak route protection, unsafe output, and incomplete release hygiene. The fastest hardening path is to enforce explicit access decisions ( entityQuery()->accessCheck() ), protect state-changing routes with CSRF requirements, ban unsafe rendering patterns, and ship every release with a repeatable security gate. The Problem Contrib maintainers usually do not get breached by exotic 0-days. They get burned by small, repeatable mistakes under release pressure: Querying entities without explicit access intent. Exposing privileged routes with weak permission or CSRF coverage. Letting untrusted data hit output without strict escaping/sanitization. Shipping releases without a structured security review checkpoint. On modern Drupal, these gaps are avoidable, but only if the checklist is explicit and enforced in CI/review. The Solution Use this hardening checklist before every