Dependency Management

Scanning Tools

The SSM.ro platform uses two automated scanning tools for dependencies and code:

Tool	Type	Coverage	Frequency
SAST static analysis	SAST (Static Application Security Testing)	Application — detects vulnerabilities in source code	Continuous, on every build
SCA dependency scanning	SCA (Software Composition Analysis)	Package dependencies — detection of known vulnerabilities	Continuous, on every build

Advisory Sources

In addition to automated scanning, the team monitors:

Heroku advisories — security notifications for the stack and add-ons in use
AWS advisories — notifications for the AWS services in use (S3, Lambda, API Gateway, etc.)
GitHub security advisories — Dependabot alerts for repository dependencies

Remediation Flow

Vulnerability identified (SAST / SCA / advisory)
    │
    ▼
Triage: severity and real impact assessment
    │
    ▼
Remediation: patch implemented as Pull Request
    │ tested in staging
    ▼
Merge into main (mandatory PR review)
    │
    ▼
Automatic deploy → Heroku production

Remediation SLAs

Severity	Maximum remediation deadline
Critical	7 days
High	30 days
Medium	90 days
Low	Best-effort, in the next release cycle

Critical vulnerabilities follow the same PR flow but on an expedited timeline — the normal release cycle is not awaited.

Periodic Review

Open advisories are reviewed monthly to:

Assess newly identified findings
Monitor the progress of remediations in progress
Adjust priorities based on actual risk

Scope

Server-side packages — all application dependencies
Client-side packages — all JavaScript dependencies in the frontend/tooling
Heroku stack / runtime — updated by SSM.ro upon release of a new stack; tested in staging before promotion to production
Platform (Heroku, AWS managed services) — updated by the provider; SSM.ro monitors the advisories