I posted the following in the main Drupal.org forums, and someone suggested it might be better placed in this group:
I just saw the security advisory regarding OG Forum, and was distressed to see that there was no fix for it - the only advice was to disable the module.
There is one site I maintain where that module plays a really critical role - to just disable it, with no alternative, would cause huge problems. But obviously, I can't leave it up there if it's got major security holes that will never be fixed! So I really need to find a workable alternative.
What the site needs is basically a way of allowing each member to have a small, private forum, which is only accessible to that member plus a small handful of other people. It also needs to be fairly easy and intuitive to use. Can anyone recommend another way of accomplishing that apart from OG Forum?
Actually, looking at what happens when you click "create discussion" here, it looks like it's just using the story content type, rather than any kind of a forum as such. But it's also possible to see the stories without being a member, which for the site I'm using OG Forum on it can't be - the individual discussion areas have to be private, as people often need to discuss confidential subjects there.
I should add that I will also need to migrate all the content from the existing OG forums on the site into whatever solution is chosen, as there's important content in there that they're not going to want to lose.
Any advice would be much appreciated - thanks!