>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #2863103. --> Reported by: [larowlan](https://www.drupal.org/user/395439) >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>Since we now allow anyone to create stable projects, we're partially violating the 'minimum-stability' flag of composer, as there are two classes of stable projects - those with security coverage and those without.<br> I'm planning on writing a composer plugin to warn about stable modules with no security coverage, but in order to do so, we need that metadata in composer.json.</p> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Add metadata drawn from the security-coverage opt-in field to the 'extra' attribute of composer.json so that can be interrogated by composer plugins/scripts etc.</p> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <p>Reviews</p> <h3 id="summary-ui-changes">User interface changes</h3> <p>N/A</p> <h3 id="summary-api-changes">API changes</h3> <p>?</p> <h3 id="summary-data-model-changes">Data model changes</h3> <p>?</p> > Related issue: [Issue #2766491](https://www.drupal.org/node/2766491)