sigmashake-docs — CVE response SLA
How quickly we respond to CVEs in our dependencies, in our code, or reported by a security researcher.
Classification
CVSS v3.1 severity drives response times.
| Severity | CVSS range | Response target |
|---|---|---|
| Critical | 9.0–10.0 | Patch deployed within 24 hours |
| High | 7.0–8.9 | Patch deployed within 72 hours |
| Medium | 4.0–6.9 | Patch deployed within 7 days |
| Low | 0.1–3.9 | Patch deployed within 30 days |
| Informational | 0.0 | Triaged within 30 days; no SLA |
The clock starts when (a) an upstream advisory is published, OR (b) a security researcher's report passes triage. If we discover internally, the clock starts at discovery.
Reporting
External researchers: file via [email protected]. We acknowledge
within 24 hours.
Response process
- Acknowledge. On-call confirms receipt and assigns severity.
- Investigate. Reproduce in a controlled environment; verify scope.
- Mitigate first. If fix > 12h for critical: apply config mitigation.
- Patch. Land fix in
main, deploy via standard pipeline. - Verify. Re-test the original report against the patched version.
- Disclose. Notify affected customers via support.sigmashake.com.
- Audit. Confirm patch event in service audit log.
Dependency vulnerabilities
bun audit runs nightly. The .last-audit-result sentinel captures the
latest verdict.
- Critical/High in production dependencies → emergency patch within the SLA.
- Critical/High in dev-only dependencies → patch within 30 days (supply-chain risk).
- Medium/Low in production → patch in the next regular dependency cycle.
If an upstream has no fix available within the SLA, we evaluate forking, vendoring, or removing the dependency.