How do I list modules on my site that are not covered by the Drupal security advisory policy?
I'm not aware of a report (a good home for such a thing might be the Site Audit project? (#2882555)

Here's a very quick report for D7 that shows:


Custom modules
Modules without a release covered by Security Policy


You can download this and use it with drush scr, or copy it for drush eval directly. Feel free to improve on it!

&lt;?php
$projects = update_get_available(true);
$uncovered = [];
foreach ($projects as $name =&gt; $project) {
  if (!isset($project["releases"])) {
    $uncovered[$name] = "No releases found";
  }
  else {
    $latest_release = reset($project["releases"]);
    if (!empty($latest_release["security"])) {
      $uncovered[$name] = $latest_release["security"];
    }
  }
};
print_r($uncovered);