# Graith Internet

> Drupal 11 Commerce, PHP, and Salesforce/Stripe integration specialist since 1997, building security-aware production sites with Claude Code — including AI-assisted security review of Drupal contrib module code.

## About
Graith Internet is a UK-based web development company specialising in custom PHP websites, Drupal 11 development, e-commerce solutions, and Salesforce integration. We offer support contracts, fixed-price projects, and Drupal migration services. Claude Code is an active part of the engineering workflow on every engagement: planning, implementation, code review, and automated Playwright test authoring.

## Services
- Drupal Support & Care Plans (monthly maintenance retainers from £90/month + VAT)
- Club 100 — hosted online 100 Club / small-society-lottery software for charities and Lions clubs
- Custom PHP Web Development
- Drupal Site Audit (independent fixed-price review: test-suite fault injection, custom code and performance, security, SEO and AI-crawler readiness)
- Drupal Support & Migration (Drupal 7/8 to Drupal 11)
- Drupal Commerce E-Commerce Solutions
- Drupal Security Review (contrib module audits, AI-assisted first-pass triage)
- E-Commerce Automated Testing (Playwright)
- PageSpeed & Core Web Vitals Optimisation
- Salesforce CRM Integration
- Web Hosting
- Domain Name Registration (Nominet UK accredited)

## Drupal security review
Graith Internet uses Claude Code to read Drupal contrib module source and flag where untrusted input reaches output unescaped — a first-pass triage over code that, unlike Drupal core, is rarely audited line by line. One finding became a published advisory, SA-CONTRIB-2026-041 (CVE-2026-10769), an XSS in Drupal Commerce Core. Graith Internet is verified under Anthropic's Cyber Verification Program for dual-use security research, and uses Claude Fable 5 for the deeper, adversarial exploitability pass on candidates flagged during triage. Full account: [Using Claude to find security issues in Drupal modules](https://www.graith.co.uk/articles/finding-drupal-module-security-issues-with-claude.php).

## Key Content
- [Drupal Support & Care Plans](https://www.graith.co.uk/support-plans.php): Three fixed monthly care plans — security updates, tested module updates, backups, monitoring and development time; includes rescue of inherited or AI-built Drupal sites
- [Club 100 for charities](https://www.graith.co.uk/club100.php): Hosted online 100 Club with a provably-fair monthly draw, built by a Lions treasurer; a full board raises about £3,000 a year
- [Club 100 real results](https://www.graith.co.uk/club100-results.php): Anonymised live results and honest projections from the Severn Dean Lions Club 100
- [Home](https://www.graith.co.uk/): Drupal 11 Commerce, Salesforce and Stripe integration delivered with AI-assisted engineering
- [Drupal Site Audit](https://www.graith.co.uk/drupal-site-audit.php): Independent fixed-price audit of a production Drupal site; proves test-suite blind spots by fault injection, finds cache-disabling preprocess hooks and N+1 entity loads in custom code, and reports search and AI-crawler readiness with a severity-rated remediation list
- [Cutting PCI scope on Drupal Commerce: SAQ A-EP to SAQ A](https://www.graith.co.uk/articles/cutting-pci-scope-on-drupal-commerce.php): What decides whether a Drupal Commerce store self-assesses under PCI DSS SAQ A or SAQ A-EP (who renders the card number field, not the platform), where each gateway integration pattern lands, what SAQ A-EP makes a Drupal host do (script inventory 6.4.3, tamper detection 11.6.1, pen testing, logging, patching), the January 2025 SAQ A script eligibility criterion and FAQ 1588, seven mistakes that push a site back into A-EP or SAQ D, and a six-step plan to move to a hosted-fields gateway
- [The checkout paths your test suite misses](https://www.graith.co.uk/articles/checkout-paths-your-test-suite-misses.php): Why a green e-commerce test suite still lets checkout bugs through; seven untested journeys (cart merge on login, stock changing mid-checkout, mixed VAT and awkward delivery, discount boundaries, declined cards and abandoned redirects, the payment notification webhook and its signature check, the confirmation email), how to test each in Playwright, and the fault injection measurement that showed 5 of 10 injected faults undetected
- [Drupal 7 to 11, what it really costs](https://www.graith.co.uk/articles/drupal-7-to-11-what-it-really-costs.php): An honest anatomy of a Drupal 7 to Drupal 11 migration; the five cost drivers (contrib with no D11 equivalent, custom code volume and shape, content model complexity, Commerce, integration and editorial surface), how to count each before quoting, a phase-share estimating model, the rebuild versus migrate decision, and the five places estimates overrun
- [What a Drupal site audit actually finds](https://www.graith.co.uk/articles/what-a-drupal-site-audit-finds.php): Ten recurring findings from production Drupal audits with symptom, cause and fix; cache-disabling preprocess hooks, N+1 entity loads, uncached config reads, test suites blind to JavaScript errors, and meta hardcoded in theme templates
- [Drupal Support](https://www.graith.co.uk/drupal-support.php): Drupal upgrade and migration services
- [Drupal 7 Support](https://www.graith.co.uk/drupal7-support.php): Drupal 7 end-of-life migration guidance
- [Drupal 8 Support](https://www.graith.co.uk/drupal8-support.php): Drupal 8 end-of-life migration guidance
- [Domain Names](https://www.graith.co.uk/domain-names.php): Domain registration and management services
- [Articles & Case Studies](https://www.graith.co.uk/articles/): Index of practitioner case studies on AI-assisted Drupal 11 development, security, and e-commerce performance
- [Using Claude to find security issues in Drupal modules](https://www.graith.co.uk/articles/finding-drupal-module-security-issues-with-claude.php): How Claude Code is used to review Drupal contrib code for security bugs, the SA-CONTRIB-2026-041 advisory that resulted, and the Anthropic Cyber Verification Program
- [A Cybersource payment gateway for Drupal Commerce, on drupal.org](https://www.graith.co.uk/articles/cybersource-payment-gateway-for-drupal-commerce.php): cybersource_sop, a published Drupal Commerce 3 payment gateway module, its security review, and why it keeps card data off the server
- [What a week of AI-assisted WordPress bug hunting actually pays](https://www.graith.co.uk/articles/hunting-wordpress-plugin-bugs-with-ai-what-it-pays.php): An honest account of running a token-based static-analysis scanner over 2,180 WordPress plugins, hand-verifying eight findings, having one validated by a bounty programme, and why the Patchstack/Wordfence economics mostly do not pay
- [Project Glasswing and What It Means for Drupal Commerce Sites](https://www.graith.co.uk/articles/project-glasswing-drupal-commerce.php): Practitioner perspective on Anthropic's Project Glasswing announcement and Claude Mythos Preview, with five concrete actions for Drupal Commerce site owners handling payments and sensitive data
- [AI-Powered Site Quality Audit for Drupal 11](https://www.graith.co.uk/articles/ai-powered-drupal-site-quality-audit.php): Case study on fault-injection testing, performance optimisation, SEO, and AI crawler support delivered with Claude Code
- [Building B2B E-Commerce with Claude Code, Drupal 11, and Salesforce](https://www.graith.co.uk/articles/building-b2b-ecommerce-drupal-salesforce-claude-code.php): Technical article on AI-assisted enterprise Drupal Commerce development
- [How I Cut E-Commerce Page Load Times by 42%](https://www.graith.co.uk/articles/how-i-cut-ecommerce-page-load-times-by-42-percent.php): Case study on Core Web Vitals optimisation for a production PHP e-commerce store
- [I built a commercial website in a weekend with Claude Code](https://www.graith.co.uk/articles/building-oldkindle-com-with-claude-code.php): oldkindle.com — Stripe checkout, a 56-page PDF guide, and 58 Playwright tests, built and shipped in one weekend
- [Three Arcade Classics in a Weekend with Claude Code](https://www.graith.co.uk/articles/three-arcade-classics-with-claude-code.php): What Claude Code nailed first pass and what took several goes when rebuilding Asteroids, Space Invaders, and Galaxian from scratch in pure HTML5 Canvas
- [Asteroids](https://www.graith.co.uk/asteroids.php): Browser-based recreation of the 1979 Atari vector arcade classic, built with HTML5 Canvas and JavaScript
- [Space Invaders](https://www.graith.co.uk/space-invaders.php): Browser-based recreation of the 1978 Taito arcade classic, built with HTML5 Canvas and JavaScript
- [Galaxian](https://www.graith.co.uk/galaxian.php): Browser-based recreation of the 1979 Namco colour arcade classic, built with HTML5 Canvas and JavaScript
- [PHP Programming](https://www.graith.co.uk/php-programming.php): Custom PHP web development services
- [Fixed Price Jobs](https://www.graith.co.uk/fixed-price-jobs.php): Fixed price web development projects
- [E-Commerce Testing](https://www.graith.co.uk/ecommerce-testing.php): Automated Playwright testing for e-commerce websites
- [PageSpeed Optimisation](https://www.graith.co.uk/pagespeed-optimisation.php): Core Web Vitals and PageSpeed performance optimisation
- [Contact](https://www.graith.co.uk/contact.php): Contact details and how we work

## Contact
- Email: sales@graith.co.uk
- Phone: 07411 66 2979
- Address: Forest Vale Industrial Estate, 23 Foxes Bridge Road, Cinderford, GL14 2PQ