Vulnerability Management

Polyaxon is committed to maintaining the security of its systems and protecting customer data. Our vulnerability management program is a key component of this commitment, designed to identify, assess, prioritize, and remediate security vulnerabilities in a timely manner.

Identification

We employ a multi-layered approach to identify potential vulnerabilities:

• Automated Scanning: We utilize industry-standard tools, including GitHub code scanning and Snyk, to continuously scan our codebase, dependencies, and infrastructure for known vulnerabilities.
• External Penetration Testing: Polyaxon undergoes regular penetration tests conducted by independent third-party security experts. Findings from these tests are integrated into our remediation process.
• Responsible Disclosure Program: We encourage security researchers to report potential vulnerabilities through our responsible disclosure program.
• Internal Reviews: Our engineering teams conduct regular security reviews of code and infrastructure configurations.

Triage and Remediation

Identified vulnerabilities are triaged based on severity and potential impact. High-priority vulnerabilities are addressed promptly according to predefined Service Level Agreements (SLAs). Our remediation process involves:

1. Assessment: Understanding the vulnerability's impact and exploitability.
2. Prioritization: Ranking vulnerabilities based on risk.
3. Remediation: Applying patches, configuration changes, or code fixes.
4. Verification: Confirming the vulnerability has been successfully addressed.

Secure Application Development

Polyaxon practices continuous delivery, which means all code changes are committed, tested, shipped, and iterated on in a rapid sequence. A continuous delivery methodology, complemented by pull request, continuous integration (CI), and automated error tracking, significantly decreases the likelihood of a security issue and improves the response time to and the effective eradication of bugs and vulnerabilities. Release notes and details for Polyaxon can be found on the GitHub release page and changelog.

Minimum Supported Versions

We maintain a compatibility matrix to inform our users about the latest releases and the minimum supported versions. As soon as we detect a security issue we make a new release and update the compatibility matrix.

Compliance

Our vulnerability management processes are designed to align with SOC 2 Type II and ISO 27001 requirements. This includes maintaining a formal Vulnerability Management Policy, regular scanning, timely remediation, and detailed record-keeping.

---