Vulnerability Management Policy
This policy describes how Bunker monitors the vulnerabilities affecting its platform and how it responds to them. On that dimension, it implements the principles of our information security policy and covers controls A.5.7, A.8.7, A.8.8, A.8.19 and A.8.23 of the Statement of Applicability.
Our controls are self-assessed, aligned with ISO/IEC 27001, not certified by a third party to date. The status of each measure below reflects that self-assessment.
Purpose and scope
This policy applies to the whole stack we operate: self-hosted open source components, application dependencies, container images, node operating systems and the managed services we run for our customers. It covers monitoring, triage, remediation and verification of vulnerabilities.
Principles
- Our critical components are open source. We can read the code, follow upstream advisories and fix without waiting for a vendor's schedule.
- Fix rather than work around. Updating the component is the default answer; edge filtering reduces exposure in the meantime, it does not replace the patch.
- Reduce the surface before monitoring it. An internal registry, minimal images, hardened admission and default-deny networking limit what can be reached at all.
- A reported flaw is a contribution. Researchers who report a vulnerability to us get a published framework and our legal protection.
- A fix is verified. A vulnerability is only closed once the corrected version is deployed and the exposure is confirmed gone.
Measures
| Area | Measure |
|---|---|
| Threat intelligence | CVE and advisory monitoring across the whole stack, supported by a monitoring agent that tracks vulnerabilities continuously (A.5.7). |
| Patching | Automated dependency updates, integrated only if every acceptance gate of the continuous integration pipeline is satisfied (A.8.8). |
| Scanning in CI | Blocking secret scanning in continuous integration; automated CVE detection (dependency scanning) still to be wired into CI (A.8.8, partial). |
| Malware | Surface reduction: internal registry, pinned image tags, hardened admission. A dedicated anti-malware image scan is still to be added to the CI pipeline (A.8.7, partial). |
| Software provenance | Provenance controlled through the internal registry, pinned tags and security admission; digest pinning and blocking admission to be strengthened (A.8.19, partial). |
| Edge filtering | A web application firewall (CrowdSec, virtual patching) fronts the critical edge and reduces exposure while a fix is being deployed; coverage to be generalised to the other entry points (A.8.23, partial). |
| External reporting | Public reporting channel, acknowledgement within 48 hours and rules of engagement published in our responsible disclosure policy (A.6.8). |
Responsibilities
- The CISO (François-Guillaume Ribreau) owns this policy, the triage of vulnerabilities and the arbitration of urgent fixes.
- The SRE on-call handles exploited or actively exploitable vulnerabilities as an incident, under the incident management procedure.
- Anyone on the team who spots a vulnerability, in our code or in an upstream component, reports it to [email protected].
- External reports arrive on the same channel and follow the same handling.
Status and roadmap
Threat intelligence is in place (A.5.7). It covers the whole stack and continuously feeds our update decisions. The four other controls in this policy are partial, and we would rather say so:
- A.8.8, technical vulnerabilities: automated dependency updates and secret scanning are operational; automated CVE detection still to be wired into CI.
- A.8.7, malware: surface reduced by construction; anti-malware image scanning still to be added to the CI pipeline.
- A.8.19, software installation: provenance controlled; digest pinning and blocking admission to be strengthened.
- A.8.23, web filtering: WAF in place on the critical edge; coverage to be generalised to the other entry points.
Beyond these four items, independent security review remains planned (A.5.35). An external penetration test is scheduled as part of the ISO 27001 certification effort, our internal review resting today on CVE monitoring and mandatory merge request review.
Review
This policy is reviewed at least once a year and whenever our technology stack or our detection capabilities change significantly.
Last reviewed: 31 August 2026.
See also
- Statement of Applicability (the status of controls A.5.7, A.8.7, A.8.8, A.8.19 and A.8.23)
- Responsible disclosure policy (how to report a vulnerability to us and what we guarantee in return)
- Secure Development Policy (the continuous integration pipeline these scans run in)
- Change Management Policy (the flow through which a fix reaches production)
- Security model (the software supply chain and the associated defence layers)