Answers.Body: <p><em>Adapted from my response on MM:</em></p>
  <p>In terms of penetration testing that's host specific, the point of penetration testing is to test the entire system, it's as much about your local/server configuration as the PHP code. The CiviCRM codebase has benefitted from several third party audits for security which have resulted in security releases but, and this is important. It's only as secure as your server is configured to be.</p>
  <p>We could have the best, most secure PHP code in the world - but a minor misconfiguration on your hosting risks negating it entirely.</p>
  <p>The security of CiviCRM, like any other application also relies on regular updates to maintain security - for example any version less than 5.35.1 or the latest ESR (5.33.3?) has known security holes unless manually patched (or updated to one of those supported versions)</p>
  <p>Some organisations choose to maintain additional security by separating CiviCRM onto a separate host/server from their website or having CiviCRM behind their firewall in their LAN.</p>
  <p>There is some information on our security processes and releases here: <a href="https://civicrm.org/security" rel="nofollow noreferrer">https://civicrm.org/security</a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-04-01T10:56:22.623Z
Answers.LastActivityDate: 2021-04-01T10:56:22.623Z
Answers.UserDisplayName: HomoTechsual
Body: <p>I have been using CiviCRM for over five years.  I am trying to encourage a local charity who provides care to vulnerable people to move to CiviCRM.  I have been asked by the project manager the following &quot;I am looking at the security of CiviCRM and wonder if there has been any security testing of the product that you are aware of e.g. hacking of the website or the database? Has there been any penetration of the site performed?&quot;  I would like to respond to them and would be grateful for any help, or advice on this.</p>
  <p>Regards
  Graham Clarkson</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-03-28T13:51:31.673Z
Comments.Text: This is a duplicate of [How secure is CiviCRM?](https://civicrm.stackexchange.com/questions/19096/how-secure-is-civicrm).
Comments.UserDisplayName: Demerit
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-03-29T04:09:26.647Z
Comments.Text: mostly i agree it is a duplicate, though this also specifically asks about what has been done in terms of penetration testing. we have had one client who funded such testing and am sure others have also, which is probably how the last vulnerability that got fixed was picked up. I don't think there is any one place you can find a full summary of those penetration tests as that info would belong to the client/owner who funded it. You may get some more interesting discussion on this in ~townsquare in the https://chat.civicrm.org/civicrm/
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-03-29T15:21:12.527Z
Comments.Text: Do you not think that is more a question for the hosting party rather than CiviCRM itself? The penetration tests I would do on my site tell a lot about my site but very little about CiviCRM on another site?
Comments.UserDisplayName: ErikH - CiviCooP
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-03-31T16:15:02.963Z
Comments.Text: Thank you for your comments.  I did read the original issue before raising this.  I thought that the penetration question and the time elapsed since the previous post warranted me raising it again.  I will pass all this on and raise it on ~townsquare , as suggested.
Comments.UserDisplayName: gcpower
Tags: <security>
Title: How secure is CiviCRM
ThreadText: # How secure is CiviCRM
  
  (Asked by: username_0 on 2021-03-28)
  
  I have been using CiviCRM for over five years. I am trying to encourage a local charity who provides care to vulnerable people to move to CiviCRM. I have been asked by the project manager the following "I am looking at the security of CiviCRM and wonder if there has been any security testing of the product that you are aware of e.g. hacking of the website or the database? Has there been any penetration of the site performed?" I would like to respond to them and would be grateful for any help, or advice on this.
  
  Regards
  Graham Clarkson
  
  **Tags:** security
  
  > **Comments:**
  > **username_1**: This is a duplicate of [How secure is CiviCRM?](https://civicrm.stackexchange.com/questions/19096/how-secure-is-civicrm).  
  > **username_2**: mostly i agree it is a duplicate, though this also specifically asks about what has been done in terms of penetration testing. we have had one client who funded such testing and am sure others have also, which is probably how the last vulnerability that got fixed was picked up. I don't think there is any one place you can find a full summary of those penetration tests as that info would belong to the client/owner who funded it. You may get some more interesting discussion on this in ~townsquare in the https://chat.civicrm.org/civicrm/  
  > **username_3**: Do you not think that is more a question for the hosting party rather than CiviCRM itself? The penetration tests I would do on my site tell a lot about my site but very little about CiviCRM on another site?  
  > **username_0**: Thank you for your comments.  I did read the original issue before raising this.  I thought that the penetration question and the time elapsed since the previous post warranted me raising it again.  I will pass all this on and raise it on ~townsquare , as suggested.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_4 on 2021-04-01. Score: 3
  
  *Adapted from my response on MM:*
  
  In terms of penetration testing that's host specific, the point of penetration testing is to test the entire system, it's as much about your local/server configuration as the PHP code. The CiviCRM codebase has benefitted from several third party audits for security which have resulted in security releases but, and this is important. It's only as secure as your server is configured to be.
  
  We could have the best, most secure PHP code in the world - but a minor misconfiguration on your hosting risks negating it entirely.
  
  The security of CiviCRM, like any other application also relies on regular updates to maintain security - for example any version less than 5.35.1 or the latest ESR (5.33.3?) has known security holes unless manually patched (or updated to one of those supported versions)
  
  Some organisations choose to maintain additional security by separating CiviCRM onto a separate host/server from their website or having CiviCRM behind their firewall in their LAN.
  
  There is some information on our security processes and releases here: <https://civicrm.org/security>
  
  
  ---
  
  