Atelier Atelier by AIncient Labs

Blog ·

When a security advisory lands

What to do in the hours after a critical flaw is announced in the software under your website — and the move Atelier has that most sites don't: switch the application off and keep the site up.

· AIncient Labs

  • security
  • appliance
  • publishing

Last week Drupal core and PHP both announced critical flaws that let an attacker run code on a server. Every Atelier site runs on Drupal, so every owner asked the same thing: what do I do in the next hour?

CONTAIN FIX RECOVER minutes hours a day or two advisory published 1Hear 2Freeze 3Lock down 4Verify 5Update 6Check 7Go live vulnerable window narrowed once frozen closed site degraded patched full site back at step 7
The window opens when the advisory is published, not when you read it. Freezing narrows it in minutes; locking down closes it. The update makes the fix permanent.

The short version

the whole playbook 
# 2 · Freeze: visitors get saved pages
atelier site freeze --label "before-incident"
# 3 · Lock down: application off, site up
cd ~/.atelier && docker compose stop app
# 5 · Update: patch and restart the application
atelier app update
# 7 · Go live, once you've checked
atelier site live

Subscribe to /security/feed.xml so you hear first. The full runbook has every step, check and command.

The move most sites can't make

On most hosts the program is the website: switch it off and the site is gone. Atelier puts a small web server in front of the application, and once the site is frozen, that server can answer visitors on its own.

a visitor reading pages everything else forms, search, sign-in front door snapshot (files) "back soon" page Drupal + database switched off nothing to attack pages keep loading
Locked down, the only thing running in public is a file server.

Freezing alone isn't enough. Signing in, forms and the console still reach the application, and an attacker can pose as any of them. Stopping the application is what closes the window.

Degraded, not down

Live Frozen Locked down Exported elsewhere
Pages load Yes Yes Yes Yes
Forms Yes Yes No No
Search Yes No No No
Sign in and edit Yes Yes No Not on that host
Application reachable by an attacker Yes Yes No No

Losing forms and search for a few hours is a real cost. It's still better than taking the site offline, or leaving it exposed until the patch lands.

Roadmap. Lockdown is a Docker command today. One command and one button — atelier site lockdown — are next, and moved up our list this month.

Before you go live again

Patching closes the hole. It doesn't tell you whether anyone came through.

  • Look: new accounts or roles, pages that differ from your frozen snapshot, odd entries in atelier app logs.
  • Rotate: if code could run on the server, replace your AI provider key and everyone's passwords.
  • Restore, don't repair: found something? Restore a backup from before the window, then update again.

Details for each are in the runbook.

Plan B: host it somewhere else

atelier site export --base-url https://your-domain.com --zip

Put the folder on any static host (guide) and switch your server off entirely. Same trade-off as lockdown. A one-click version is on the roadmap.

Atelier is an AI-first website builder that runs on your own machine, with your own AI provider key. The source is on GitHub; install is one command. Found a security issue? See SECURITY.md.