Skip to content

Vulnerability Triage Procedure

Supports: ../policies/vulnerability-management-policy.md. Owner: OPS (infra/deps) / INFRA (application). Evidence: the fix PR per finding; the threat-model gap register. Ties: SEC-10, SEC-14, SEC-15.

Purpose

Turn a raw vulnerability signal into a confirmed, prioritized, tracked-to-closure fix — consistently, so nothing slips.

Sources handled

Dependency/SAST scan output (once wired into CI), container image scans, threat- model and per-PR review findings, pre-launch pentest findings (M5), and responsible-disclosure reports.

Steps

  1. Intake. Record the finding: source, affected component, description, and any CVE/advisory reference.
  2. Confirm. Reproduce or verify it applies to Partile's actual usage — drop confirmed false positives with a one-line reason (so they aren't re-triaged).
  3. Rate severity per the policy SLA table:
  4. Critical (auth bypass / data exposure / remote exploit) → fix/mitigate ≤ 48h
  5. High → ≤ 7 days
  6. Medium → ≤ 30 days
  7. Low → next planned cycle Weight Partile-specifically: anything touching auth, presence/location data, block separation, or the LinkedIn identity anchor rates up.
  8. Assign a role owner (INFRA for app, OPS for infra/deps).
  9. Decide path: patch/upgrade, code fix, config change, or risk-accept (dated, with compensating control, per ../policies/risk-management-policy.md).
  10. Fix via the change process (release-review-procedure.md): the patch lands as a reviewed PR with a test where feasible; for an authz/IDOR class, extend the cross-user 404 regression test (SEC-15).
  11. Escalate to incident if the vulnerability is being or has been exploited (incident-response-playbook.md).
  12. Close & record. Link the fix PR; update the threat-model gap register and any affected control row (e.g. SEC-10 when JWKS verification lands).

Known open items (tracked)

  • SEC-10 — JWKS id_token verification (implemented in infra PR-16; keep linkedin_oidc_smoke.py green).
  • SEC-14 — dependency scanning + pre-launch pentest (not started).
  • SEC-15 — IDOR regression smoke exists manually; CI wiring is not started.

Done when

Each finding is either fixed (with linked PR + test) or risk-accepted (dated, with compensating control), and the relevant control row reflects it.