How are vulnerabilities prioritized and resolved?
amaise follows a documented vulnerability management policy with defined SLAs:
Severity | SLA | Examples |
Critical | 72 hours | Remote code execution, data leak, credential exposure |
High | 14 days | Authentication bypass, SQL injection, privilege escalation |
Medium | 90 days | XSS, CSRF, information disclosure |
Low | Next release | Misconfigurations, best practice deviations |
Process:
Detection (automated scanning, penetration testing, external report)
Triage and severity assignment by security officers
Ticket creation with security label
Resolution within the SLA
Verification and closure
Zero-day vulnerabilities are subject to the 72-hour SLA with immediate escalation. Automatic dependency checking (CVSS ≥ 7 breaks the build) provides instant visibility of new vulnerabilities.