# Concept: Security and Regular Updates

## Prerequisite knowledge

* [Concept: Drupal as a Content Management System](/link/681)
* [Concept: Modules](/link/682)
* [Concept: Themes](/link/683)
* [Concept: The Drupal Project](/link/686)
## What are security updates?

Any software occasionally has bugs, and sometimes these bugs have security
implications. When security bugs are fixed in the core software, modules, or
themes that your site uses, they are released in a _security update_. When
critical security updates are announced, they will be shown in the
administration pages of your website. You will need to apply security updates in
order to keep your site secure. See [Keeping Track of Updates](/link/781) to learn how to be
notified of security updates by email, and [Updating the Core Software](/link/782),
[Updating a Module](/link/783), and [Updating a Theme](/link/784) to learn how to make
updates.
## What is the security team?

The Drupal open-source project has a team of volunteers who track
security-related bugs and release security updates. They also help other
developers fix bugs, and maintain information for users on how to keep their
websites secure. You can learn more about the security team and their practices
and processes at the
[_Drupal.org_ Security Team](https://www.drupal.org/drupal-security-team/general-information) page.
## How are security bugs reported?

It is important that security problems be kept confidential until they are
fixed, so that sites are less likely to be compromised before they can be
secured. If you find a potential security problem in any of the software you
downloaded from the _Drupal.org_ website, follow the procedures on the
[_Drupal.org_ Security Team](https://www.drupal.org/drupal-security-team/general-information) page to report
it.
## What are regular (non-security) updates?

The core software, modules, and themes also periodically have regular updates to
add new features and fix bugs. These updates are less critical than security
updates. As a general best practice, updates should be applied as long as they
do not cause problems with your site. Testing on a development copy of your site
is always a good idea before applying updates on a live site. This is because
some updates may include changes that are not compatible with the modules or
themes on your site, or that will break a particular functionality on your site.
## Related topics

* [Keeping Track of Updates](/link/781)
* [Updating the Core Software](/link/782)
* [Updating a Module](/link/783)
* [Updating a Theme](/link/784)
* [Making a Development Site](/link/767)
## Additional resources

* [_Drupal.org_ community documentation page "Securing your site"](https://www.drupal.org/security/secure-configuration)
* ["Security advisories" on Drupal.org](https://www.drupal.org/security)
* [_Drupal.org_ Security team](https://www.drupal.org/drupal-security-team/general-information)