Are there security standards for each stage of a module on Drupal.org?

Create sandbox project > full project with dev version only > official release

What is the process for the security of contrib modules? Do audits happen?

Historically, I have functionality rather than security on my mind when selecting a contrib module. Partly because I don't know how to easily evaluate security (that is, without studying the entire code). How can I evaluate how secure a contrib module is?

1 Answer 1


Currently there is no correlation between project status and presumed security of code. From The Security Team Handbook page

in general the team does not review core nor contributed code

The Drupal security team works to resolve vulnerabilities that others find. Any review that happens to sandbox modules would be part of normal project review (no guarantees). When code is explicitly reviewed for security, it is most likely because someone was hired to review it.

In general, you can use the Writing Secure Code guide as a starting point. Also checkout presentations from Cons and Camps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.