IT-Community - Gemeinsam Lernen und Lehren

Since early in the project's history, Drupal has adopted a fully transparent policy towards security. A dedicated security team has a transparent and methodical process to review any reported issue—whether in Drupal core or contrib. If in core,RH202 a trusted core contributor is tasked to implement a fix in an expedited fashion, followed by re-review by the security team. If in contrib, the module maintainer is asked to implement the fix,E20-520 followed by a review. Once obtained, the security team announces the nature of the vulnerability and the availability of the fixed code in a timely manner, so that site administrators can immediately take remedial action. Though this policy tends to lead observers to think that Drupal has a high number of security issues, there is no proof that this is the case;70-640 the Drupal project's transparent approach is generally considered superior to the alternative—security through obscurity.