Drupal has one of the best security teams in open source. Full stop.
When they find a problem, the fix ships fast. For every supported version. With a clear risk score, a plain explanation, and a workaround for anyone who can't update yet.
That's not a crisis. That's a system working exactly as designed.
A dedicated security team. Coordinated disclosure. Advisories every week, written for humans. Supported versions with dates you can plan around. Thousands of eyes on every line of code.
And it's all public. Anyone can read how every issue was found, rated and fixed.
Drupal doesn't hide its vulnerabilities. It fixes them, fast, in public.
That's why governments trust it. That's why I build on it.