Web Development

This blog post explains how to securely enable Drupal's web-based composer functionality on a FreeBSD system, which restricts the `www` user for security reasons (no shell, no home directory). While most users won’t need to expose composer to the web server, Drupal CMS introduces convenient module management through composer and requires it. Since the `www` user can't access environment variables through traditional shell methods, the guide outlines a solution using `php-fpm`, which allows passing the composer path via environment variables. The guide covers enabling `php-fpm` on FreeBSD, configuring Apache to connect to the `php-fpm` process using the correct handler syntax, and ensuring both services are restarted, making it possible to use composer through Drupal’s interface without compromising system security.

The post explores how Snyk, a security scanning tool, fits into modern CI/CD pipelines by enabling developers to catch vulnerabilities early during development, not just at the end like in traditional waterfall models. While CI/CD automates code integration and unit testing, it doesn’t check for security issues — and that’s where Snyk adds value.

Snyk is a strong contender for secure DevOps, especially for teams seeking seamless integration with development tools and continuous security monitoring.