Why has my security shield for my new module on Drupal.org been removed? I have recently managed to create a module on drupal.org, by following the entire process from Sandbox-&gt;Project Application-&gt;Module Publish.

However after few weeks my module lost the security shield, and am getting this message instead:


  This project is not covered by the security advisory policy.
  It may have publicly disclosed vulnerabilities. Use at your own risk!


I have gone through some of the documentation (Security advisory process and permissions policy), but I couldn't find suitable explanation.

Here is a screenshot of how it looks like now:



My questions:


Why has my module been tagged with this message? 
How can I resolve it, or how can I find what is wrong in my module?
Only full releases get the security shield. Your screenshot only shows a dev version. I don't think the shield was removed from your module, as it wouldn't have had one in the first place since you don't have a full release.

To get the security shield, you'll need to release a full version (one not suffixed with -dev, -alpha or -beta). 

** EDIT **

I have just discovered that an additional step needs to be taken in addition to creating a full release. Until recently, if a module was given a full-release, it automatically received the security advisory. However, I just promoted a module I've got from RC to a full release, and it did not receive the security advisory. Editing the module page now has an option that requires to module maintainer to opt into the security advisory.

Even having done so, my module still does not have the advisory shield, so I assume it now goes under some review from the security team before receiving it. This issue seems to support that assumption: https://www.drupal.org/node/2666584

--- Edit 2 ----

It turns out their was a bug in the system. I am already able to promote modules to drupal.org rather than the sandbox. With existing modules, when upgrading from D7 -> D8, modules were automatically given the shield when I released a full version. However the module I mentioned above did not have a D7 version, and when I promoted it to a full release it didn't receive the shield. After waiting two weeks for approval I finally contacted the security team, and they looked into it and found a bug in the caching system, and fixed it.

So it appears that the original information I gave - that you just need to release a full version, and have opted into security advisory coverage, is correct.

Here's a screenshot of the module edit page.