In trying to cover various elements of the current situation with WordPress, we have run in to a pre-existing issue, the lack of almost any official information on the WordPress security team or teams. This is very different than how other similar, but smaller, projects handle things. You can easily find a lot of information for the teams for both Drupal and Joomla, including who is on the teams and their scope. It isn’t even clear how many teams there are for WordPress or if they actually exist as a team.
Recently, Matt Mullenweg cited the “WordPress security team” when announcing the takeover of the plugin Advanced Custom Fields. He linked to the WordPress.org Security page when mentioning that. That page mentions a team labeled as the WordPress Security Team: [Read more]