1. Purpose
This document describes how vulnerabilities in Ayonix Zoomer and its dependencies are discovered, assessed, fixed and verified — and how quickly.
2. Sources
| Source | Mechanism | Cadence |
|---|---|---|
| Static analysis (SAST) | GitHub CodeQL, security-extended | Every pull request and push; weekly |
| Dependency advisories (SCA) | npm audit, Dependabot, GitHub Advisory Database | Every pull request and push; weekly |
| Secret exposure | gitleaks across full history | Every pull request and push; weekly |
| Dynamic analysis (DAST) | OWASP ZAP baseline against the running service | Weekly and before a significant release |
| External reports | security@ayonix.com | Continuous |
| Penetration test | Third-party engagement | Not yet performed; planned before general availability |
3. Triage and rating
Findings are rated with CVSS v3.1 as a starting point, then adjusted for how this system is actually built. Two adjustments are routine:
- Raised where biometric data, evidence images, authentication or tenant isolation are reachable.
- Lowered where the vulnerable code path is provably unreachable here — for example an advisory about dynamic SQL identifiers in a component this codebase only ever calls with static identifiers. The reasoning is recorded, and the dependency is still upgraded.
Every finding is triaged within 3 business days. Anything touching biometric data is triaged the same day.
4. Remediation targets
| Severity | Target | Interim action |
|---|---|---|
| Critical (9.0–10.0) | Fix within 7 days | Contain immediately: disable the path or block at the edge |
| High (7.0–8.9) | Fix within 30 days | Mitigate if a fix is not immediate |
| Medium (4.0–6.9) | Fix within 90 days | Scheduled |
| Low (0.1–3.9) | Next convenient release | Tracked |
High and critical advisories in runtime dependencies fail the build, so shipping past one requires a deliberate, recorded exception rather than inattention.
5. Exceptions
Where a fix is not available or would break the service, a time-boxed exception is recorded with the reasoning, the compensating control and an expiry date. Exceptions are reviewed at expiry, not forgotten. Exceptions are not available for critical findings that touch biometric data.
6. Verification
Every fix goes through the normal pipeline — tests, type check, lint, SAST, dependency audit — and is verified in production afterwards. Where a fix upgrades a component the unit tests do not meaningfully exercise, such as the database layer, an end-to-end run through the application is required as well.
7. Coordinated disclosure
- Report to security@ayonix.com.
- We acknowledge within 3 business days and give an initial assessment within 10 business days. If a fix will take longer, we say why rather than going quiet.
- Please do not access, modify or retain other people's data while testing, and do not run denial-of-service tests against production.
- We credit reporters who wish to be credited. We do not currently operate a paid bounty.
- We will not pursue legal action against good-faith research conducted within these terms.
8. Metrics
We track open findings by severity, time to triage, time to remediate against target, and exceptions outstanding past expiry. These are reviewed at least quarterly.