Drupal Association Interim CEO Tiffany Farriss on how AI is making vulnerabilities cheap to find, and what the Drupal community is doing to keep fixing them safely.

In this episode:
• Why AI-assisted analysis is “an everyone problem” for open source security
• What five months of Alpha-Omega funded SEIR work has meant for the Drupal Security Team and its volunteers
• How site owners, hosts, and organizations can help, starting with Drupal Steward coverage

Read the full transcript: https://www.drupal.org/association/blog/in-the-open-security-in-the-age-of-ai

In the Open with Tiffany Farriss is a weekly series from the Drupal Association, the non-profit that maintains Drupal.org, coordinates Drupal security, and supports the global Drupal community. New episodes every week. Subscribe to follow along.

Produced with thanks to Stephen Cross of Second Signal Media.

Drupal Association Interim CEO Tiffany Farriss on how AI is making vulnerabilities cheap to find, and what the Drupal community is doing to keep fixing them safely.

In this episode:
• Why AI-assisted analysis is “an everyone problem” for open source security
• What five months of Alpha-Omega funded SEIR work has meant for the Drupal Security Team and its volunteers
• How site owners, hosts, and organizations can help, starting with Drupal Steward coverage

Read the full transcript: https://www.drupal.org/association/blog/in-the-open-security-in-the-age-of-ai

In the Open with Tiffany Farriss is a weekly series from the Drupal Association, the non-profit that maintains Drupal.org, coordinates Drupal security, and supports the global Drupal community. New episodes every week. Subscribe to follow along.

Produced with thanks to Stephen Cross of Second Signal Media.

Drupal Association Interim CEO Tiffany Farriss on why Drupal’s commons is under pressure, how the Drupal Certified Partner program is evolving, and what it takes to keep free software running for the next 25 years.

In this episode:
• What the ecosystem and business surveys revealed
• Why the Drupal Certified Partner program is becoming the Drupal Certified program
• The $40 in donated services every Drupal site receives each year, and who shoulders that cost
• Making contribution visible, expected, and recognised

In the Open with Tiffany Farriss is a weekly series from the Drupal Association, the non-profit that maintains Drupal.org, coordinates Drupal security, and supports the global Drupal community. New episodes every week. Subscribe to follow along.

Produced with thanks to Stephen Cross of Second Signal Media.

Drupal Association Interim CEO Tiffany Farriss on why Drupal’s commons is under pressure, how the Drupal Certified Partner program is evolving, and what it takes to keep free software running for the next 25 years.

In this episode:
• What the ecosystem and business surveys revealed
• Why the Drupal Certified Partner program is becoming the Drupal Certified program
• The $40 in donated services every Drupal site receives each year, and who shoulders that cost
• Making contribution visible, expected, and recognised

In the Open with Tiffany Farriss is a weekly series from the Drupal Association, the non-profit that maintains Drupal.org, coordinates Drupal security, and supports the global Drupal community. New episodes every week. Subscribe to follow along.

Produced with thanks to Stephen Cross of Second Signal Media.

Contribution using LLMs, the policy, and etiquette around it is a topic that has come up in some recent posts here as well as in other places such as in the Drupal community Slack and the issue queue. So it’s quite serendipitous that a session touching on this is coming up soon, on Wednesday, November 4, 2026 at 2:00pm Eastern Standard Time.

Figured it’s worth sharing here for those who might be interested.

Whether it’s your employer, your clients, or your favorite open source project, we all have AI policies to navigate now. Drupal has one too, and it was written with a lot of care for both contributors and the people who review their work.

In this session, Stephen Mustgrave joins us to introduce the policy on the use of AI when contributing to Drupal. Stephen has led the Needs Review Queue Initiative for several years, checking in on Drupal core issues as they reach “needs review.” That gives him a front-row view of what helps an issue move forward and what slows it down.

We’ll start with the why. Committers are responsible for the codebase, and they need to understand every change they commit. Every contribution to an issue should help clarify the problem and the proposed solution. AI-generated summaries can add cognitive load for reviewers and, even when the contributor understands the change perfectly well, they don’t show it. The result is that the work of understanding shifts onto someone else.

Then we’ll get practical:

What the policy asks of contributors
- The updated issue summary templates, including the new section for AI output
- Why reviewers ask for summaries written in your own words, and what makes a good one
- How to ask AI to explain a solution so you understand it well enough to describe it yourself

We’re coming at this from a place of enthusiasm. AI tools have made it possible for more people to contribute to Drupal, and that energy is a good thing. Let’s talk about how to channel it into contributions that move issues forward and keep everyone in the chain, from contributor to reviewer to committer, on the same page.

Bring your questions and your own policies too. If you maintain contributed projects, we’d love to hear how you’re handling AI-assisted contributions.

This seems pretty interesting.