Symphony.

Given some discussions, such as this one, in the past regarding security and cases of reporting vulnerabilities, it might be a good idea to be explicit about the community’s policy regarding the process of reporting potential or actual security risks.

I came across this security policy that provided some good guidelines that we could adapt as a community.

Is there a more secure way of reporting potential vulnerabilities to Symphony developers other than in this public forum?

I think the Textpattern policy gives a good summary. I like that it is present and not hidden somewhere on their site.

Agreed. Textpattern’s security reporting policy makes a lot of sense and is something we should adopt and promote more formally.