Vulnerability Management Policy
1. Scope
This policy covers the Koana application code, its third-party packages, the live application at app.koanaworks.com and related addresses, and the cloud services Koana runs on.
2. How vulnerabilities are found
- Static analysis (SAST): Semgrep, with TypeScript/JavaScript, OWASP Top 10 and secrets rule sets. Runs on every change and every week.
- Secret scanning: gitleaks. Runs on every change and every week.
- Dependency audit: runs on every change and every week. Automated update requests (Dependabot) arrive weekly.
- Dynamic scan (DAST): an OWASP ZAP baseline scan of the live application, every week.
- Provider notices: security notices from Cloudflare, Supabase, GitHub, Google, Zoom and Meta are monitored.
- Outside reports: anyone can report a concern to contact@koanaworks.com.
Every scan result is sent automatically to Koana's administration console. Critical and high findings alert the administrators straight away.
3. Severity and fix times
| Severity | Examples | Fix within |
|---|---|---|
| Critical | exposed secret; unauthenticated access to data; exploitable flaw in a production package | 7 days (exposed secrets are rotated the same day) |
| High | authorization bypass needing a sign-in; high-severity production package issue | 30 days |
| Medium | missing hardening header; moderate package issue | 90 days |
| Low / informational | best-practice suggestions | next planned maintenance |
Issues in build-time or test-only tools that never ship to users are rated one level lower, unless they can affect the release process.
4. Tracking
- Each confirmed vulnerability is recorded in the vulnerability register with its source, severity, owner, due date and resolution.
- A monthly summary is generated from the scan history.
5. Exceptions
If a fix cannot be made in time, for example while waiting on a vendor patch, an administrator records:
- the reason;
- any compensating measures;
- a new date, no more than 90 days away.
The exception is reviewed on that date.
6. Responsible disclosure
We acknowledge reports within 3 business days, keep the reporter informed, and do not take action against good-faith research that avoids harming users or their data.