Hey All

I've got a new day job and I'll be overseeing a rewrite and expansion of the existing web infrastructure for the business. I'm keenly showcasing SS as the right tool for this job, one of the final objections/questions I've got is how secure is SilverStripe/sapphire core.

With all standard disclaimers of code/server being as secure as the dev/admin who sets it all up, is there a solid review of security in SilverStripe/Sapphire that I can head towards? A third party review even better?

It's great to show the consistent comments from the core dev team all around the web on various blogs and corresponding security and point releases.

Can you point me towards a good solid review of SS in/security and/or provide me with a quick list of points to assist me in winning over this discussion and the boss man himself?

Thanks in advance guys
dizzy

I'm aware of three code audits commissioned by clients since 2.4.0, so we've got a lot of eyes on the product at least.
I don't think you'll find a "security review" as such, I hope that any security issues would be confidentially reported to us rather than blogged as a review.