Why this exists.

isdrupalsecure.org publishes primary-source documentation about Drupal's security capacity, funding and exploitation record. It is written for the people who have to make a decision: a CTO with a renewal date, a security lead with a risk register, a procurement officer with an agency proposal. Not for the people who already have.

It is not affiliated with the Drupal Association, the Drupal Security Team, any Drupal vendor, or any competitor. It takes no money from either side of the migration market. “Drupal” is a registered trademark of Dries Buytaert, who owns and controls it. The policy governing its use, including the logo, is published on drupal.org. The word appears here descriptively, to identify the software under discussion: no Drupal logo, wordmark, typeface or page design is reproduced or imitated, no licence is claimed, and nothing on this site implies sponsorship, certification or endorsement by any trademark owner.

Editorial position

We think Drupal's security function is structurally underfunded and that the project has now said so itself. That is an argument, and it is labelled as one. The facts underneath it are not opinions, and each one links to a document you can read without us.

Funding

None. There is no advertising, sponsorship or affiliate revenue on this site. If that ever changes, the disclosure appears here first and on every page that it affects.

Contact

Corrections, right of reply, source suggestions: corrections@isdrupalsecure.org. We answer documented corrections first.

Reuse

Charts and tables may be reproduced with attribution and a link. The written analysis is © isdrupalsecure.org. If you are putting a figure from this site into a board paper, take the Tier 1 source from the footnote instead of citing us. It is the better citation, and it is the point of the exercise.