**copy of mail response sent to Chris earlier***

The two documents at the bottom of http://security.dotnetnuke.com are still valid. They're due a refresh, but the material is still relevant and all the security API methods and recommendations are in place. We will be updating them later this year to contain updated capabilities and advice - a lot of the additional material can be found on the wiki in the security section

http://www.dotnetnuke.com/Resources/W...

We receive reports from a number of automated security scanners, penetration tests and security researchers - whilst we can't release the details of these publically (as they contain user specific details), you can see some of the (anonymized) details on blogs posts such as

http://www.dotnetnuke.com/Resources/B...

We don't put DotNetNuke through security compliance certification at present as it would be time-consuming, costly and ultimately not very useful thing. Security certification's are very useful for complete products, but a web application framework such as DotNetNuke is designed to be extended pretty much from the outset - as the certification would only apply to the base install, installing a single extensions (skin/module/provider) would make the certification invalid.

However, thanks to the large number of reports from multiple independant tools and vendors, we're confident that we're following best practices and performing solid due-diligence to ensure possible issues do not get introduced.

I wrote up a blog post on the OWASP top 10 and how DotNetNuke complies against it, which highlights a number of our practices and core protections, that may be of interest

http://www.dotnetnuke.com/Resources/W...