Drupal Triples Core Security Credits and Expands Sponsorship Recognition

Following changes to Drupal.org's contribution-credit system, the Drupal Association confirmed on 21 October 2026 that core issues are now worth 15 weighted credits instead of ten, while core security advisories are worth 150 instead of 50. The changes are live, and the Association said some organisations have already moved in Drupal Marketplace rankings.

The revised weights affect how organisations receive recognition for contributing to Drupal's underlying software. Weighted credits influence marketplace visibility and help determine eligibility for different levels of the Drupal Certified Partner programme. The Association said the changes are intended to better reflect the effort involved in maintaining core and responding to security issues.

According to the Association's 21 October announcement, the new 15-credit baseline represents a 50% increase for standard Drupal core issues. Core security advisories receive ten times that baseline, bringing their value to 150 credits. Although the multiplier is tenfold, the credit awarded for a core security advisory has increased threefold from the previous 50.

The Association linked the higher weights to the demands placed on core contributors. Organisations have supported strategic initiatives such as Drupal CMS, Drupal Canvas and Drupal AI, but those efforts continue to depend on Drupal core. The announcement also said the Security Team and core release managers are handling a growing volume of AI-generated security reports, increasing the demands on those responsible for reviewing issues and preparing releases.

Other parts of the contribution-credit system remain unchanged. Issues associated with strategic initiatives continue to receive ten credits, while contributed-project security advisories retain a multiplier of five times the project's normal credit weight. The minimum credit value remains one, and contribution weights for other projects continue to scale with reported usage.

The Association has also expanded its core sponsorship recognition scheme to cover active Security Team members, subsystem maintainers and topic maintainers. These roles join existing core leadership positions eligible for monthly base credits when organisations sponsor their work. The additional credits recognise ongoing responsibilities such as maintenance, coordination and oversight that may not consistently produce individual issue credits.

The official core sponsorship table specifies monthly credit rates according to the maintainer's role and the amount of sponsored time. Sponsoring an active subsystem maintainer for one day per week earns an organisation 50 base credits per month, while equivalent sponsorship of an active topic maintainer or Security Team member earns 75 credits. At five sponsored days per week, those amounts rise to 250 and 300 respectively. The Association specifies that credits apply only to sponsored hours during which the contributor is actively engaged in the relevant work.

The sponsorship credits supplement recognition earned through individual issues and are intended to encourage organisations to fund recurring maintenance responsibilities. They do not represent payments made by the Association to contributors, nor do higher credit values establish that new financial sponsorship has been secured. The distinction matters because the policy changes how support is recognised without demonstrating a corresponding increase in maintainer funding.

The expanded recognition comes amid documented gaps in Drupal's maintenance structure. A September 2026 investigation by The DropTimes found that 15 of the 28 subsystem and topic maintainer vacancy areas identified during Drupal's 2025 recruitment process remained unassigned in the current core roster. REST was an additional unassigned area, bringing the total to 16. The revised sponsorship credits provide an incentive for organisations to support these roles, although their effect on recruitment and available maintainer time has not yet been established.

The changes also have implications for Drupal Certified Partners, whose certification tiers depend partly on annual weighted contribution credits. The Association said it checks quarterly for partners that qualify for higher tiers and can process upgrades upon request between scheduled reviews. Organisations that no longer meet their existing tier requirements will not be downgraded until the end of their current term. Changes in marketplace rankings therefore do not necessarily result in immediate changes to partner certification.

The Association's 21 October announcement also promised a companion list identifying core contributors seeking sponsorship. The live sponsorship page now includes a section listing two contributors, identified by their Drupal.org usernames as xjm, a core release manager, and ckrina, a user experience manager. The listing gives xjm availability of up to 32 hours per week and up to 700 monthly base credits for a sponsor, and ckrina up to 20 hours per week and up to 500 credits. These are estimated sponsorship-credit amounts, not payments to contributors; the page advises organisations to confirm availability and arrangements directly. The 21 October announcement described the list as forthcoming, but the date on which it was added to the live page has not been established. Whether the revised credit weights will produce additional sponsorship commitments or help fill vacant maintenance roles remains to be seen.