Session API Security Advisory I'm working on a website that is interested in adding chat features. I did some research, and ended up installing the DrupalChat module, and its dependencies. After configuring the module, I realized it would not work for anonymous users unless I also installed the Session API module.

My concern is that on the Session API module information page, it displays a banner stating that


  This project is not covered by Drupal’s security advisory policy.


I have not run into this issue before, so I'm not sure how leery I should be to use the Session API module?

Does this mean it's likely to receive a future update to address pending security issues? Should I use some other method of adding chat to the web site? If so, any recommendations?
Basically all this means is that the module maintainers haven't opted into Security Advisory Coverage yet. Seems they haven't even opened an application in the review queue.

I asked them to do so in a new issue. As also Acquia does not recommend implementing modules not covered under the Security Advisory Policy (article). Pantheon takes that as a red flag (article), too.

But I wouldn't be worried too much. Just remember to always update this module first. But yeah, I'm not a security expert :)