Added security best practices

[SniperSister]

No description provided.

[qodo-code-review]

PR Summary by Qodo

Add security best-practices guide for Joomla extension developers

📝 Documentation 🕐 10-20 Minutes

AI Description

• Add a new “Security” page under Building Extensions with security process best practices.
• Document coordinated disclosure workflow, CVE guidance, and advisory writing recommendations.
• Link extension-focused guidance back to the core Security fundamentals documentation.

Diagram

graph TD
  A["Docusaurus docs"] --> B["Building Extensions section"] --> C["Security best practices page"] --> D["Security fundamentals page"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Place disclosure/CVE guidance under /docs/security only

• ➕ Keeps all security-related guidance centralized in one section
• ➕ Reduces duplication risk across extension-focused and general security docs
• ➖ Extension developers may miss process guidance when starting from Building Extensions
• ➖ Less contextual framing for extension release/advisory workflows

2. Add a reusable SECURITY.md + advisory template to the repo

• ➕ Gives maintainers copy/paste starting points (policy, timelines, crediting)
• ➕ Makes the guidance immediately actionable
• ➖ Requires ongoing maintenance to stay aligned with the narrative docs
• ➖ May be out of scope for a docs-only PR

Recommendation: The current approach (a dedicated Building Extensions security page that links back to Security fundamentals) is a good fit for the target audience and avoids overloading the generic security section. Consider a follow-up to add prominent cross-links from /docs/security/index.md to this new page and (optionally) include template files (SECURITY.md / advisory template) to make the guidance more actionable.

Files changed (1) +568 / -0

Documentation (1) +568 / -0

security.mdAdd security best-practices documentation for extension maintainers +568/-0

Add security best-practices documentation for extension maintainers

• Introduces a new documentation page describing security reporting channels, confidential handling, validation and severity assessment (CVSS), coordinated disclosure, CVE assignment, and guidance for writing and publishing advisories. Includes recommended timelines and communication practices, and links readers to the existing Security fundamentals documentation.

docs/building-extensions/security.md

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗