Vulnerability Management Policy

Purpose

This policy establishes how Close-Rate identifies, assesses, prioritizes, and remediates security vulnerabilities across our application, infrastructure, and third-party dependencies. The goal is to minimize our attack surface and reduce the window of exposure for known vulnerabilities.

Vulnerability Identification

We identify vulnerabilities through the following channels:

• Dependency Monitoring: Python dependencies (pip) and JavaScript dependencies (npm) are monitored for known CVEs. Our GitHub Actions CI runs pip-audit (backend) and npm audit (frontend) on every build, and results are reviewed monthly.

• AWS Security Advisories: We monitor AWS security bulletins for vulnerabilities affecting RDS, ECS, and S3.

• Vendor Notifications: We subscribe to security advisories from Clerk, Anthropic, OpenAI, Zoom, and other integrated services.

• Manual Code Review: Security-sensitive changes (authentication, token handling, data access) undergo peer review before deployment.

• Responsible Disclosure: External researchers can report vulnerabilities to client-services@close-rate.com.

Severity Classification

• Critical (CVSS 9.0+): Remote code execution, authentication bypass, data breach risk. Remediation target: 24 hours.

• High (CVSS 7.0-8.9): Privilege escalation, significant data exposure. Remediation target: 72 hours.

• Medium (CVSS 4.0-6.9): Limited impact vulnerabilities, information disclosure. Remediation target: 2 weeks.

• Low (CVSS 0.1-3.9): Minimal risk, defense-in-depth improvements. Remediation target: next release cycle.

Patching & Remediation

• Critical and high-severity vulnerabilities are patched as emergency releases outside the normal release schedule

• Dependency updates are reviewed and applied at least monthly

• AWS managed services (RDS, ECS Fargate platform versions) receive automatic security patches from AWS

• Python and Node.js runtime versions are updated quarterly to maintained LTS versions

• Fixable high- and critical-severity dependency advisories are remediated. A small number of residual advisories have no shippable fix: the frontend's remaining high/critical findings are build-time-only transitives of react-scripts (Create React App), which are not present in the shipped production bundle and are tracked for a planned CRA-to-Vite migration; one backend transitive (ecdsa) has no upstream fix and is not on the authentication path

• When a direct patch is not available, compensating controls (WAF rules, input validation, feature flags) are applied as interim mitigations

Secure Development Practices

• All database interactions use parameterized queries via SQLAlchemy ORM to prevent SQL injection

• Input validation enforced at the API boundary using Pydantic models

• Secrets and credentials stored in environment variables, never committed to source control

• Error messages returned to clients are generic — detailed error information is logged server-side only

• Authentication tokens are validated on every API request with proper expiration and signature checks

Responsible Disclosure

We welcome responsible disclosure from security researchers. If you discover a vulnerability in Close-Rate:

• Email client-services@close-rate.com with a description of the vulnerability

• Include steps to reproduce, if possible

• We will acknowledge receipt within 24 hours

• We will provide an initial assessment within 72 hours

• We ask that you do not publicly disclose until we have had a reasonable opportunity to remediate