sigmashake-docs — CVE response targets
How quickly we respond to CVEs in our dependencies, in our code, or reported by a security researcher.
Classification
CVSS v3.1 severity drives response times.
| Severity | CVSS range | Remediation target |
|---|---|---|
| Critical | 9.0–10.0 | Patch deployed within 72 hours |
| High | 7.0–8.9 | Patch deployed within 7 days |
| Medium | 4.0–6.9 | Patch deployed within 30 days |
| Low | 0.1–3.9 | Patch deployed in the next planned release |
These are targets, not guarantees. This table matches the Vulnerability Management Procedure. That procedure is the source of truth for patch targets.
The clock starts when (a) an upstream advisory is published, OR (b) a security researcher's report passes triage. If we discover internally, the clock starts at discovery.
Reporting
External researchers: file via [email protected]. We aim to acknowledge
within 72 hours (target).
Response process
- Acknowledge. On-call confirms receipt and assigns severity.
- Investigate. Reproduce in a controlled environment; verify scope.
- Mitigate first. If a critical fix is not ready in time: apply a config mitigation.
- Patch. Land fix in
main, deploy viawrangler(no CI pipeline runs). - Verify. Re-test the original report against the patched version.
- Disclose. Publish the advisory on the security advisories page. Then a staff member sends the advisory email by a manual step (
POST /api/advisories/:id/notify). No automatic notification exists. New accounts are enrolled on a best-effort basis. Existing accounts are not backfilled. - Audit. Confirm the patch commit in the repository history.
Dependency vulnerabilities
A locally scheduled bun audit --prod run records its latest result in the
.last-audit-result sentinel. The run is not a blocking gate, and it can miss
runs when the machine is asleep or the timer is disabled.
- Critical/High in production dependencies → emergency patch within the remediation target.
- Critical/High in dev-only dependencies → patch within 30 days (supply-chain risk).
- Medium/Low in production → patch in the next regular dependency cycle.
If an upstream has no fix available within the remediation target, we evaluate forking, vendoring, or removing the dependency.