EZBudget™
Vulnerability Management Policy
Identification, prioritization, and remediation of vulnerabilities affecting dependencies and platforms.
1. Policy Statement
Deseo Developers LLC identifies and remediates security vulnerabilities affecting Finducation / EZBudget application dependencies and the managed platforms that host production workloads. Because production runs on serverless managed infrastructure (Netlify Functions and Supabase), operating-system and hypervisor patching for production compute is primarily performed by those platform providers; application-layer vulnerability management is the responsibility of Deseo Developers LLC.
2. Scope
- npm and other application dependencies used in production builds
- Build and runtime configuration (Node version, Netlify settings)
- Application code defects with security impact
- Platform advisories from Netlify, Supabase, Stripe, and Plaid that affect our integration
This policy does not claim continuous vulnerability scanning of all employee or contractor laptops, nor scanning of self-managed production server fleets. Production compute is serverless and managed by cloud providers.
3. Identification Methods
- Periodic dependency advisory review using package-manager tooling (e.g.,
npm audit) - Review of GitHub/security notices and Dependabot-style alerts when enabled for the repository
- Provider security bulletins for Netlify, Supabase, Stripe, and Plaid
- Findings from internal assessments, partner questionnaires, and (when performed) penetration tests
- Repository security check script for SQL injection anti-patterns
4. Prioritization and Remediation Targets
| Severity | Examples | Target Response |
|---|---|---|
| Critical | Remote code execution in a production dependency; auth bypass; secret exposure | Begin remediation immediately; aim to mitigate or patch within 7 days |
| High | Privilege escalation; significant data exposure risk in used package/code path | Remediate within 30 days |
| Medium / Low | Limited exploitability, unused code paths, or low impact | Remediate within 90 days or accept risk with documented rationale |
5. End-of-Life Software
- Production Node runtime is pinned and reviewed at least annually for supported LTS status.
- Dependencies that are abandoned or reach end-of-life are replaced or removed when they present material risk.
- Managed platform EOL (e.g., deprecated Netlify/Supabase features) is tracked via provider notices.
6. Endpoint and Production Asset Context
- Production: No self-managed VMs or container fleets; vulnerability patching for the underlying platform is performed by Netlify and Supabase.
- Developer endpoints: Maintainers are responsible for keeping workstations updated with OS security patches and enabling built-in malware protection (see Endpoint Security Policy, EZB-END-001).
7. Tracking and Closure
- Material vulnerabilities are tracked until remediated, mitigated, or formally accepted.
- Significant incidents related to vulnerabilities follow the Incident Response Policy (EZB-IR-001).
8. Periodic Review
- This policy is reviewed at least annually.
- Planned improvements include enabling automated dependency alerts on the repository and expanding continuous integration security checks.
9. Related Documents
- Change Management and Secure SDLC Policy (EZB-CHG-001)
- Endpoint Security Policy (EZB-END-001)
- Penetration Testing Policy and Program (EZB-PEN-001)
- Incident Response Policy (EZB-IR-001)
10. Approval
Approved By: Deseo Developers LLC — Authorized Representative
Date: July 22, 2026
Contact: contact@deseodevelopers.com