CiviCRM Community Forums (archive)

Hi, after haven gone through the idea list, I find this project idea of Hardening CiviCRM Security very intersting to me. Security is an issue that should seize the attention of every organization that uses or develop web-based platforms. In the case CiviCRM which is built on PHP, I presume all the security functionality that comes within the PHP's default configuration file, php.ini has been fully utilized. If that is the case, I wish to have more discussion on this in order to build a very robust list of security requirements for CiviCRM.

Regards
 

<<Did you read the project idea?>>
Yes I have gone through the project idea and
<<what do you think about it>>
 I think it is imperative for a huge project like CiviCRM to be able to afford  a  detailed  security  review. And for us to achieve this, a thorough penetration test will have to be performed on the system so that we can identify all security loopholes on the current system adding to the ones already identified as per the discussion on the project idea page. This will then give us a good place to start building.
<<how you can contribute?>>
I will like to contribute first by working to working to fix the already identified security loopholes and then performing a detailed penetration test on CiviCRM to identify and close more security back-doors.

I wil like to get more  recommendations, especially if in your opinion I'm missing out on it.

Regards