The enterprise OpenSource content management system which is available for free at https://www.drupal.org where you can find all the details and also references.
has a very active community with tens of thousands of developers all around the world and they also have a huge focus on standard compliance and on security.
Almost all websites have one requirement in common: getting notified when something specific is happening. Whether that's a new blog post, a new comment, a modified version of a node, an exception in the logs or a deleted user account, either the site admin or website visitors would like to know about some or all of these.
As a team that had spend time and money for years in developing best practices for staging, deployment and operations of many Drupal sites on version 5 to 7, the all new Drupal 8 came with some surprises and challenges in 2015, when first alpha and then beta releases started to see the light. Where all of Drupal core up to Drupal 7 had been exposed in the main project folder, all the contributed code from the Drupal community and third parties was located deep down in the code tree with custom code for the specific project sometimes was hard to separate from other contributions.
Drupal 8 projects are in most cases controlled by Composer and following best practices, the directory structure of a Drupal project looks similar to this (more details have already been covered here):
