A new version of DNN has hit because of a small vulnerability having been found, but I've found out only by accident and some time after the release.

It would be handy if we were able to sign up for receiving security bulletins and/or core release announcements. Presumably a public role could be created that people can subscribe/sign up to that can then be used as the basis for a Newsletter-style mailing to inform people of the release?

Although the Annoucements section exists in the Forums, this is for the general marketplace and I wouldn't want to be e-mailed whenever a new post is added there. Instead, I want to know about releases of the core product, most importantly because of any vulnerabilities found.

It would be a lot more beneficial than the MarketPlace Monitor.

Hi Andrew,

Currently the DotNetNuke security policy is "pull-only" and may be access via RSS subscription.  You can read more about the security policy itself here.

If you have any security concerns with the platform that are not covered by existing security bulletins, I would suggest you begin a dialog with the security@dotnetnuke.com alias for immediate investigation.

Hope this helps!

Brandon