This page explains how I handle security in my Joomla extensions, and tracks an ongoing review of everything I've published.

Why this review exists

Something has shifted in the last couple of years. Weaknesses that would once have taken weeks of patient code reading to uncover can now be surfaced in an afternoon by anyone with an AI model and the inclination. That cuts both ways — it helps the people looking to fix problems and the people looking to use them, and it applies to code written last month as much as to code written in 2010 that nobody has had reason to re-read since.

Rather than wait to find out which side gets there first, I'm working through every extension I maintain, one at a time, reviewing the code specifically for security problems. Where I find something, I fix it, release it, and email the people who hold a license for that extension.

How I handle a finding

I go looking, rather than waiting to be told. Every issue found through this review was found by me, on my own initiative. None of it came from a report of a compromised site.

I tell you, even when nobody would have noticed. It would be easy to fold a fix into a routine release and describe it as "hardening." I'd rather say plainly what was wrong, so you can judge how urgently you need to update.

I don't publish how to trigger it. Notices describe the class of problem and include the standard CWE classification so you or your developer can look it up independently. I don't publish working detail, because not everyone updates on the day the email arrives.

I tell you if a site was affected. So far, nothing found in this review has been linked to an exploited site. If that ever changes, the notice will say so.

What I ask of you

Keep your extensions updated. Most of the risk in any Joomla site comes not from undiscovered problems but from known ones left unpatched for months. When a security notice arrives from me, it means I'd genuinely like you to act on it.

Reporting a problem

If you believe you've found a security issue in one of my extensions, please contact me directly rather than posting it in the forums. Tell me the extension, the version, and what you observed.

Review progress

Each entry below is marked with the month its review was completed. A completed review doesn't mean an extension will never need another security fix — it means the code has been examined for this class of problem and whatever was found has been released.

Last updated: August 2026.