[[security-concept]]

=== Concept: Security and Regular Updates

[role="summary"]
Overview of security updates, how bugs are handled, and non-security updates.

(((Security,overview)))
(((Update,overview)))
(((Bug,reporting)))
(((Security bug,reporting)))
(((Security team,overview)))

==== Was man wissen sollte

* <<understanding-drupal>>
* <<understanding-modules>>
* <<understanding-themes>>
* <<understanding-project>>

==== What are security updates?

Any software occasionally has bugs, and sometimes these bugs have security
implications. When security bugs are fixed in the core software, modules, or
themes that your site uses, they are released in a _security update_. You will
need to apply security updates in order to keep your site secure. See
<<security-announce>> to learn how to be notified of security updates by
email, and <<security-update-core>>, <<security-update-module>>, and
<<security-update-theme>> to learn how to make updates.

==== What is the security team?

The Drupal open-source project has a team of volunteers who track
security-related bugs and release security updates. They also help other
developers fix bugs, and maintain information for users on how to keep their
websites secure. You can learn more about the security team and their practices
and processes at the
https://www.drupal.org/drupal-security-team/general-information[_Drupal.org_ Security Team] page.

==== How are security bugs reported?

It is important that security problems be kept confidential until they are
fixed, so that sites are less likely to be compromised before they can be
secured. If you find a potential security problem in any of the software you
downloaded from the _Drupal.org_ website, follow the procedures on the
https://www.drupal.org/drupal-security-team/general-information[_Drupal.org_ Security Team] page to report
it.

==== What are regular (non-security) updates?

The core software, modules, and themes also periodically have regular updates to
add new features and fix bugs. These updates are less critical than security
updates. As a general best practice, updates should be applied as long as they
do not cause problems with your site. Testing on a development copy of your site
is always a good idea before applying updates on a live site. This is because
some updates may include changes that are not compatible with the modules or
themes on your site, or that will break a particular functionality on your site.

==== Ähnliche Themen

* <<security-announce>>
* <<security-update-core>>
* <<security-update-module>>
* <<security-update-theme>>
* <<install-dev-making>>

==== Additional resources

* https://www.drupal.org/security/secure-configuration[_Drupal.org_ community documentation page "Securing your site"]
* https://www.drupal.org/security["Security advisories" on Drupal.org]
* https://www.drupal.org/drupal-security-team/general-information[_Drupal.org_ Security team]


*Attributions*

Written and edited by https://www.drupal.org/u/batigolix[Boris Doesborg]
and https://www.drupal.org/u/jhodgdon[Jennifer Hodgdon].
