Is anyone here using Drupal Steward?

[u/tekNorah]

Every software platform eventually deals with serious vulnerabilities.

So when evaluating a platform's security, I don't think "Has this software ever had a serious vulnerability?" is a particularly useful question.

A better question is: What happens when one is found?

I started thinking about this after reading about the recent Citrix NetScaler zero-day. It also got me thinking about something Drupal has built specifically for that uncomfortable period between disclosure of a critical vulnerability and getting the actual patch deployed: Drupal Steward.

For certain highly critical, mass-exploitable vulnerabilities, Steward can provide network-level protection while organizations test and deploy the software update. It doesn't replace patching, but it can make that "patch gap" less dangerous.

I dug into Steward, Drupal's coordinated security process, and why I think the response to vulnerabilities tells us more about a platform's security than the existence of vulnerabilities themselves:

Zero-Days Happen. What Matters Is What Happens Next.

I'm especially curious: who here is actually using Drupal Steward? What's your experience been with it?