Contrib.social

Remove Drush from the cPanel project template

Open on Drupal.org →
Created on 5 July 2025, 1 day ago

Problem/Motivation

The cPanel-compatible project template, which is based on our regular project template, includes Drush. This means that you get vendor/bin/drush accessible in the web root.

That seems not-good.

It might make sense to remove Drush from the cPanel project template only. This would be more secure out of the box, and probably more suitable for people on cheap hosting. The bad news is that it means developers working on Drupal CMS projects built with the cPanel template will need to remember to install Drush on their own.

Another option would be to move Drush to the dev dependencies of both templates, and tell Softaculous to use composer create-project drupal/cms --no-dev when spinning up Drupal CMS projects.

Or maybe a combination of both approaches? Move Drush to dev dependencies, and tell Softaculous to use --no-dev for extra safety.

Or something else? Would love some input here, because we should address this (or decide not to) sooner rather than later.

🐛 Bug report
Status

Active

Component

General

Created by

🇺🇸United States phenaproxima Massachusetts

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024