Patch Management

Remediation SLAs: Critical 7 days, High 30 days, Medium 90 days — procedure and review

Scope

Patch management covers three categories:

Category	Patching responsibility
Platform (Heroku, AWS managed services)	Updated by the provider; SSM.ro monitors vendor advisories
Heroku stack / runtime	Updated by SSM.ro when a new stack is released; tested in staging
Application dependencies (server-side and client-side packages)	Managed by the SSM.ro team

Vulnerability Identification

Source	Description
SAST static analysis	Detects vulnerabilities in application code
SCA dependency scanning	Detects vulnerabilities in packages used
Heroku advisories	Security notifications from the Heroku platform
AWS advisories	Security notifications for the AWS services used
GitHub	Dependabot alerts and security advisories for the repository

Remediation SLAs

Severity	Remediation timeframe
Critical	7 days
High	30 days
Medium	90 days
Low	Best-effort, in the next release cycle

Patching Procedure

Patch identified (SAST / SCA / advisory)
    │
    ▼
Implemented as a Pull Request on GitHub
    │ tested in the staging environment
    ▼
Merged into the main branch (mandatory PR review)
    │ Heroku webhook triggered automatically
    ▼
Automatic build & deploy via the GitHub → Heroku pipeline

Critical patches follow the same flow, but on an expedited schedule — the normal release cycle is not awaited.

Review

Open advisories are reviewed monthly to assess new findings and monitor the progress of remediations underway.