Drupal Security Team

Security Team procedures

This section of the handbook details the procedures for Drupal Security Team members. If that is not you, you can safely skip this section of the documentation unless you are particularly interested in the topic.

Drupal Security Team members provide help in several ways. This list is in the order of priority to the team.

Coordinating with security researchers who deliver reports, project maintainers responsible for fixing security issues, and our own internal process for creating an announcement.
Providing advice to project maintainers as they work through security issues.
Educating the Drupal community on security topics to improve the overall security stance of the project.
Identifying vulnerabilities and making enhancements related to security in core and contributed projects.

Adding new members to the security team

Explains how members are added and the specific places to modify access

Common tasks for Security Team members

In no particular order:

Creating a Drupal core security release

Refer to the instructions for rolling a new core release.

Disclosure of usernames and user IDs is not considered a weakness

The Drupal Security Team does not consider it a vulnerability that there are ways to determine a registered members username and/or user ID.

Drupal Security Team Disclosure Policy for Security Team Members

The offical version of this policy is here: http://cgit.drupalcode.org/securitydrupalorg/tree/policies/disclosure.txt

Security Team expectations for employers

Simple explanations for employers regarding what to expect when an employee is on the Security Team

How to invite a maintainer to participate in the issue

In order to let maintainers post directly into an issue on security.drupal.org, use the "Add/update project maintainers" checkbox.

How a Security Issue goes from Initial Report to Security Advisory.

Process for Security Team new issue reports and Security Advisory publication.

Making a public issue for security.drupal.org issues with status "Needs public followup"

Process for creating public issues after Security Team has agreed on making a public version of the issue.

Marking a project as unsupported for security reasons

If a project maintainer is not responsive to fixing an issue after multiple attempts to contact them via e-mail, IRC, Skype, and/or phone,

Security issue release process

Schedule

Security Team chat channels (IRC and Slack)

Everyone on the security team has been granted access to join the restricted #drupal-security channel on freenode IRC.

Security Team member triage duty

Security Team message templates

Security issues on git.drupalcode.org

security.drupal.org is being replaced with confidential issues on git.drupalcode.org

Guide maintainers