How are patches and updates managed?
amaise follows defined SLAs for vulnerability remediation:
Severity | Remediation deadline |
Critical (RCE, data leak, credential exposure) | 72 hours |
High (auth bypass, SQL injection, privilege escalation) | 14 days |
Medium (XSS, CSRF, information disclosure) | 90 days |
Low (misconfigurations, best practice deviations) | Next release cycle |
Detection is automated through multiple channels: dependency checks at every build (build fails if CVSS ≥ 7), continuous monitoring, periodic external and internal scans, as well as annual third-party penetration testing conducted in Q4.
Runtime versions are fixed and updated via the standard PR process with security scanning. Deployments are performed as zero-downtime rolling updates.