These targets apply to every security vulnerability in Rahoto, whether we find it ourselves (scans, reviews, penetration tests) or someone reports it to us.
Severity
| Severity | What it means | Examples |
|---|---|---|
| P0 Critical | Active exploitation, customer data exposed, or remote code execution in production | Authentication bypass, data visible across organisations |
| P1 High | A realistic path to elevated privilege or to sensitive data | Stored cross-site scripting in the report viewer, a request forgery that escapes the allowlist |
| P2 Medium | Needs an authenticated attacker and non-trivial effort, or weakens a layer of defence without direct impact | Cross-site request forgery on a low-risk action, a weakened rate limit |
| P3 Low | Theoretical, or needs several unlikely conditions | A missing security header on a page with no sensitive data |
When the severity is unclear, we grade one level higher and re-grade once we know more.
Response targets
| Severity | Acknowledge | Contain | Fix | We tell you |
|---|---|---|---|---|
| P0 | 1 hour | 4 hours | 24 hours | Within 24 hours, with a workaround if the fix is not complete |
| P1 | 4 hours | 24 hours | 7 days | Within 7 days, once the fix has shipped |
| P2 | 1 business day | 7 days | 30 days | In the monthly security update |
| P3 | 5 business days | 30 days | The next scheduled release | In the quarterly Trust Center update, where relevant |
- Acknowledge: the report is logged, an engineer is assigned and the severity is confirmed.
- Contain: an immediate measure removes the active risk, even before the root cause is fixed (for example switching a feature off or blocking a route).
- Fix: the root-cause fix is deployed to production.
- Business day: Monday to Friday, UTC, excluding public holidays.
- We tell you: an email to your organisation’s security contact and a notice in the Trust Center.
How a fix is handled
- Triage. Severity is set within the acknowledgement window.
- Containment. The smallest change that closes the exposure is applied first.
- Fix. The root-cause fix is reviewed by a second engineer before release. P0 and P1 fixes ship with a test that guards against the issue returning.
- Record. Every remediation is recorded in Rahoto’s audit log with its severity, owner and timeline.
- Review. P0 and P1 issues get a written post-incident review within 14 days. Affected customers can request a summary.
Reporting a vulnerability
Email [email protected] with “Security report” in the subject. Include the affected page or endpoint, the steps to reproduce and what you observed. We acknowledge reports within the targets above and keep you informed until the issue is closed.