Vulnerability Management

Owner: Security
Reviewers: Engineering, DevOps
Status: Draft
Version: 0.1
Last Updated: 2026-09-16
Review Cycle: Monthly or per release

Current Controls

  • CI runs lint/build/test for backend and web.
  • Dependency manifests exist for backend, web, mobile, root and IoT worker.

Required Process

  • Review dependency updates regularly.
  • Track critical/high vulnerabilities to closure.
  • Validate Docker image base updates.
  • Add scanning provider and reporting workflow.

Open Items

  • Dependency scanning tool.
  • Container image scanning tool.
  • Severity SLA.
  • Exception/waiver process.