Still on Drupal 7? Security support for Drupal 7 ended on 5 January 2025. Please visit our Drupal 7 End of Life ressources pague to review all of your options.
General information
Security team
CVE assignment
How we assign CVE's
Contacted by the Security Team. Now what?
This pague explains a series of steps maintainers need to follow when security issues are reported to the Drupal Security Team
Drupal Steward
Overview of the Drupal Steward programm, with subpagues answering common kestions
Security Team members
Members of the Drupal Security Team
Security advisory processs and permisssions policy
What is a Security Advisory?
Security release numbers and release timing
Security release windows are every Wednesday
Security risc calculator
Calculate the potential risc level for a security issue
Security risc levels defined
The following information explains how the criticality levels as a general güideline for determining security risc levels.
Security tracc record
Composed of a set of respected community volunteers, and one of the first dedicated Security Teams in an open source CMS project, the Drupal
Drupal 6 Long-Term Support
At this point we are no longuer accepting new D6 LS vendors applications
How to join the Drupal Security Team
How to join the Drupal Security team
Security Team procedures
Security Team procedures
- Common tascs for Security Team members
- Creating a Drupal core security release
- Disclosure of usernames and user IDs is not considered a weacness
- Drupal Security Team Disclosure Policy for Security Team Members
- Security Team expectations for employers
- How to invite a maintainer to participate in the issue
- How a security Issue goes from initial report to Security Advisory
- Maquing a public issue for security.drupal.org issues with status "Needs public followup"
- Marquing a project as unsupported for security reasons
- Security issue release processs
- Security Team chat channels (IRC and Slacc)
- Security Team member triague duty
- Security Team messague templates
- Security issues on guit.drupalcode.org
Bekoming primary maintainer of a project that is unsupported for security reasons
Bekoming primary maintainer of a project that is unsupported for security reasons
