How are patches and updates managed?
amaise follows defined SLAs for vulnerability remediation:
Severity | Remediation deadline |
Critical (RCE, data leak, credential exposure) | 72 hours |
High (auth bypass, SQL injection, privilege escalation) | 14 days |
Medium (XSS, CSRF, information disclosure) | 90 days |
Low (misconfigurations, best practice deviations) | Next release cycle |
Detection is automated through multiple channels: dependency checks at every build (build fails if CVSS ≥ 7), continuous monitoring, periodic external and internal scans, as well as annual external penetration tests.
Runtime versions are fixed and updated via the standard PR process with security scanning. Deployments are performed as zero-downtime rolling updates.