UNDA — Vulnerability Management

Status: Draft. Must be in place before Pre-Beta Gate.

Vulnerability sources

Source	Signal	Handling
Dependency scanner (dart pub outdated --mode=security + Dependabot on GitHub)	New advisory on a pinned dep	Triage within one working week; patch or drop the dep.
Static analysis (flutter analyze, dart fix)	New warning class	Address before merge.
Secrets scanner (gitleaks on pre-commit + CI)	Match	Block the commit. If already merged, rotate the secret immediately, force-push cleanup with legal sign-off.
Platform advisory (Apple / Google security bulletins)	New OS-level CVE relevant to Flutter/HealthKit/Health Connect	Assess and patch.
Third-party report (security@ mailbox)	External researcher email	See below.
Sub-processor advisory (Supabase, Strava, Garmin)	Vendor notification	Assess UNDA impact, notify users only if warranted per incident-response.md.

Public disclosure policy

• Security contact: security@ (to set up).
• Coordinated disclosure window: 90 days from acknowledgement, extendable by mutual agreement.
• Acknowledgement SLA: within 3 working days.
• Fix SLA target: severity-dependent, see table below.

Severity	Fix SLA (target)
Critical (exploitable exposure of sensitive health data)	72 hours
High (privilege escalation, auth bypass, PII exposure)	14 days
Medium (DoS, integrity issue not affecting sensitive data)	30 days
Low (informational, hardening)	Next release

Patch process

1. Reproduce the issue in a private branch.
2. Write a regression test where feasible.
3. Ship the fix.
4. Assess whether the pre-fix window constituted a breach under GDPR Art. 4(12); if yes, invoke incident-response.md.
5. Update threat-model.md if this reveals a new attacker capability.
6. Publish a security note in the release changelog for High/Critical.

CRA readiness

The EU Cyber Resilience Act reporting obligations begin 11 September 2026. Before that date UNDA must be able to demonstrate:

• A public security contact.
• A vulnerability intake process.
• A triage workflow.
• Incident classification aligned to CRA severity vocabulary (to be aligned once ENISA guidance is finalised).
• A patch workflow with SLAs.
• A regulatory-reporting assessment step (this file).
• A dependency inventory (SBOM) generated on every release.

An SBOM will be produced via dart pub deps --json at release time and archived under /docs/security/sboms/.

Dependency inventory (SBOM) — release process

• Generated at every release tag.
• Stored under docs/security/sboms/{version}.json.
• Diffed against the previous release to surface new deps in the release notes.

People

Role	Owner
Security triage rotation	TBD
SBOM owner	Release engineer / CI
External researcher liaison	Security officer