I'm not familiar with how it used to be, but Drupal does have a security advisory process[1] for contributed modules. I don't know, but I'd imagine having moved

I'm not familiar with how it used to be, but Drupal does have a security advisory process[1] for contributed modules. I don't know, but I'd imagine having moved the contrib ecosystem to Gitlab, and composer-based dependency management, has made some dimensions of security auditing easier to do at scale. I'd say it's still true that you can't easily stay 100% within that security advisory umbrella. 1. https://www.drupal.org/drupal-security-team/security-advisory-process-and-permissions-policy https://www.drupal.org/drupal-security-team/security-advisor...