Vulnerability management
By Mira Holm · created 12 Jun 2023, 12:00 UTC · last updated 1 Oct 2026, 08:40 UTC · version 8
vulnerabilitiesscanningsecurity
Owner: Mira Holm
Scanning
- Dependencies: GitHub's dependency alerts on identity-service, portal and notifier, on every change and weekly.
- Container images: scanned when built and weekly.
- The edge: a web application firewall in front of every region, which also absorbs denial-of-service traffic.
- Penetration test: once a year by an outside firm (Penetration test 2026).
How fast we fix
| Severity | Fixed and released within |
|---|---|
| Critical | 48 hours |
| High | 7 days |
| Medium | 30 days |
| Low | next quarter |
The clock starts when the finding is confirmed, not when the scanner first saw it.
Recent
| Week of | Finding | Fixed |
|---|---|---|
| 14 Sep | notifier's mail library several releases behind; nothing exposed | Brought up to date Thu 17 Sep |
| 21 Sep | High: portal's image library, used for the Access report's PDF | Released 23 Sep, two days from scan to release |
| 28 Sep | Nothing critical or high |
Ana's weekly "Security news" agent task for Halden reads this table every Monday.