As part of our annual information governance review we have to answer a question on whether all of the suppliers of our systems have cyber certifications. CiviCRM as open source software is a bit tricky to fit into this question.

Has the core code for Civi is cyber security tested in anyway, whether this is the methodology for releasing new code changes or whether the core code has ever been pen tested?

1 Answer 1


There was a Mozilla audit last year - see https://civicrm.org/blog/josh/quarterly-report-q1-2020

For general info see https://civicrm.org/security and https://docs.civicrm.org/sysadmin/en/latest/setup/security/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.