Talking points: security
This page is for advocates who are asked "is it secure?" No honest person can answer "yes" to that question for any software. What you can do is describe the process and the evidence, and show the person how to check it.
Contents
- The rule: process, not promises
- The points
- What to show
- Do not say
- When someone reports a vulnerability to you
The rule: process, not promises
| Instead of | Say |
|---|---|
| "It is secure." | "Vulnerabilities are reported privately, answered within one business day, and fixed in the next release." |
| "It has never been hacked." | "Here is the hardening guide and the checklist your administrator can follow." |
| "We take security seriously." | "Here is what the project does, with the source for each point." |
The points
| Say | Source |
|---|---|
| "Security issues are reported privately by e-mail, not in public, and you get a first answer within one business day." | SECURITY.md |
"6.0.x is the maintained line. Fixes are made on main and published with the next 6.0.x release." | Security fixes |
| "A published version never changes. A fix reaches you as the next release, so what you certified stays what it was." | SECURITY.md |
| "The administration can send a Content Security Policy; by default it is report-only there, with documented steps to enforce it." | Content Security Policy |
| "New administration templates carry no inline styles or scripts, so a strict policy can be enforced." | CONTRIBUTING.md, Styling the administration |
| "A tamper-evident audit trail records who did what; every record carries the hash of the one before." | The audit trail |
| "Two-step sign-in with an authenticator app or an e-mail code." | Two-step sign-in |
| "New installations generate a random administrator password when none or a well-known one is given." | The default administrator password |
| "Probes and attacks are classified into a security log, with masked addresses." | Request logs |
| "Administrators get a threat-by-threat hardening guide and a checklist." | Security hardening |
| "The project sends security fixes upstream too: 14 pull requests to Zeta Components in April 2026, as the se7enxweb profile reports." | The PHP stack it stands on |
What to show
On an installation you control, as an administrator:
- The Audit tab: "Your sign-in is already recorded."
/user2fa/setup: the two-step sign-in setup.- The hardening checklist on screen.
- SECURITY.md in the browser.
Never show settings files, keys, passwords or server addresses on a shared screen (Live demo safety).
Do not say
- "It is secure", "unhackable", "bank-grade", "military-grade".
- "It has never had a vulnerability." No source says so, and every serious project has had some.
- "The CSP protects you." It is report-only on the administration by default and off on the sites (Content Security Policy); the administrator decides.
- Anything about a specific vulnerability that is not public.
When someone reports a vulnerability to you
People may tell an advocate first. Then:
- Thank them and ask them not to post details publicly.
- Point them to the private address in
SECURITY.md, or GitHub's private vulnerability reporting of the repository (When something goes wrong, Security problems). - Do not forward the details in a public channel, and do not try to reproduce it on someone else's site.
- Do not promise a fix date.
The full routine is on Security reports stay private.
Related pages
- Advocating for security
- Objection: "Is open source secure?"
- Handling objections, Security
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.