Is Drupal secure?
Drupal is used in over 1 million websites all over the Internet. A bulk of these websites are government, higher ed and high-tech business sites, which process large amounts of confidential data.
In addition to a security-focused internal structure, Drupal is known for its extensive security testing and verification. As an open-source project, Drupal’s source code is open to anyone to audit and improve upon. Additionally, Drupal's Security Team takes a very hands-on approach to any bugs found and releases updates immediately upon threat verification.