DrupalSecurity is a library for automated Drupal code security reviews. It defines rules for PHP_CodeSniffer
Note that Javascript has not been supported yet. To check and fix Javascript files please use ESLint and see the Drupal ESLint documentation.
composer global require drupal-spider/drupalsecurity
Note:
You have to make sure that the phpcs command is included in the PATH environment vairalbe, otherwise you will end up a command not found error. Normally, phpcs command would locate in the user profile's folder, such as ~/.composer/vendor/bin/phpcs
Check Drupal Security standards
phpcs --standard=DrupalSecurity --extensions=php,module,inc,install,theme,yml,twig [/file/to/drupal/module]
List all sniffs
phpcs --standard=DrupalSecurity -e