Vulnerability Management Policy¶
| Field | Value |
|---|---|
| Owner | Puneet Gupta (Co-Founder) |
| Classification | Internal (shareable under NDA) |
| Version | 1.0 |
| Effective date | 2026-06-11 |
| Next review | 2027-06-11 |
1. Purpose¶
Define how Revzio identifies, tracks, and remediates security vulnerabilities across its applications and infrastructure.
2. Scope¶
The Pixis application, its dependencies, and the infrastructure on which it runs.
3. Identification¶
- Dependency tracking — application dependencies are declared in package manifests
(Python
requirements.txt, npmpackage.json) and monitored for known vulnerabilities. - Managed infrastructure — the database and hosting platform are patched by the provider.
- Software Composition Analysis (SCA) for continuous open-source vulnerability detection is being introduced. (Planned.)
- SAST/DAST automated application security testing is being introduced. (Planned.)
4. Remediation & SLAs¶
Identified vulnerabilities are triaged by severity and remediated through updates. Target remediation SLAs (being formalized):
| Severity | Target remediation |
|---|---|
| Critical | 7 days |
| High | 30 days |
| Medium | 90 days |
| Low | Best effort / next cycle |
Gaps and their closure status are tracked to resolution.
5. Penetration testing¶
An independent VAPT by a CERT-In empanelled firm covering the web application, API, and infrastructure is planned, with an at-least-annual cadence thereafter. (Planned — tracked in the CERT-In VAPT task.)
Revision history¶
| Version | Date | Author | Change | Approved by |
|---|---|---|---|---|
| 1.0 | 2026-06-11 | Puneet Gupta | Initial draft | Puneet Gupta (Co-Founder) |