The TYPO3 Security Team works to improve security in the TYPO3 content management system. They handle security incidents, answer questions, review code and extensions, and educate users. They use tools like an issue tracker, mailing lists and wikis. Reporting vulnerabilities helps them further enhance TYPO3's security.

1. TYPO3 Security Team - our infrastructure, how we work, your benefits, how to help us - by Marcus Krause <marcus@t3sec.info>

3. what we do

4. how you benefit

5. how you can help

8. Andreas Förthner (team leader v5)

9. Dmitry Dulepov

10. Lars E. D. Jensen

11. Oliver Klee

12. Marcus Krause

13. Rove Monteaux

14. Georg Ringer

15. Jochen Weiland

17. time tracker

20. separate revision control repository (planned)

22. IM

23. conference calls

24. real life meetings

26. answering security questions

27. create/review core security fixes

28. (paid) extension security reviews

29. coordination with upstream vendors

30. monitoring core commits

31. introducing new security features

32. user education

34. OpenID (sysext:openid)

35. Asymmetric encryption (sysext:rsa)

38. security news feed http://news.typo3.org/xml-feeds/

39. twitter http://twitter.com/typo3_security

41. (Extension Security Policy)

42. ISB/CSB

43. CVSS

45. vendor patches

46. no PoC

47. = responsible dislosure & least necessary information

48. Reports [email_address]

49. Reports 2009 #317

51. constantly improved

52. competitive product (open source CMS)

53. monitored third-party addons (TER)

55. quick-check of TER extension before install (DB API usage, intval, quoteStr, htmlspecialchars)

57. supporting TYPO3 Association member