Drupal Security Audit

Core and contributed module versions against published security advisories, roles and permissions, custom code for injection and access-control issues, text formats and file upload handling, settings.php and hosting configuration.

A prioritised report with the issue, risk, and a concrete fix for each finding, and optional help applying the fixes.