Patching Timelines

We maintain strict timelines for remediating vulnerabilities based on their severity, as measured by CVSS scoring:

Critical

CVSS 9.0 – 10.0 — Patched Immediately / Within 24 Hours

Emergency patches are deployed as soon as a fix is available. Affected services may be taken offline if necessary to prevent exploitation.

High

CVSS 7.0 – 8.9 — Patched Within 3 Days

High-severity vulnerabilities are prioritized and remediated within 72 hours. Mitigations are applied immediately if a patch is not yet available.

Medium

CVSS 4.0 – 6.9 — Patched Within 2 Weeks

Medium-severity issues are scheduled for the next regular maintenance window, within 14 calendar days.

Low

CVSS 0.1 – 3.9 — Patched Within 3 Weeks

Low-severity vulnerabilities are addressed within 21 calendar days as part of routine maintenance.

Vulnerability Discovery

We employ multiple methods to continuously identify vulnerabilities across our platform:

Automated Scanning: Regular automated vulnerability scans of all production infrastructure and application code
Dependency Monitoring: Continuous monitoring of third-party dependencies for known vulnerabilities using automated tools
Penetration Testing: Periodic penetration testing by qualified security professionals to identify vulnerabilities that automated tools may miss
Code Reviews: Security-focused code reviews are performed for all changes to security-sensitive components
Threat Intelligence: Monitoring of security advisories, CVE databases, and vendor notifications for emerging threats

Third-party dependencies are a significant attack surface. We manage them rigorously:

All dependencies are tracked in lock files with integrity hashes to prevent supply-chain tampering
Automated alerts notify the engineering team when a dependency has a known vulnerability
Dependencies are reviewed before adoption for security posture, maintenance activity, and license compatibility
Unused dependencies are regularly pruned to reduce attack surface

We welcome and appreciate reports from security researchers and users who discover potential vulnerabilities. Our responsible disclosure process:

Report the Vulnerability

Send details to security@adamlegalsystems.com with a description, steps to reproduce, and any supporting evidence.

Acknowledgement

We will acknowledge receipt of your report within 24 hours and provide an initial assessment within 72 hours.

Investigation & Fix

Our security team will investigate, develop a fix, and keep you informed of progress throughout the process.

Disclosure

Once the vulnerability is remediated, we will coordinate public disclosure with the reporter if appropriate.

Please Do Not

Security Team

Email: security@adamlegalsystems.com

For urgent security matters, please include "URGENT" in the subject line. We monitor this inbox 24/7.