1. Scope
The following describes how and when we resolve security bugs in our products. It does not describe the complete disclosure or advisory process that we follow.
2. Security Bug Fix Service Level Objectives (SLO)
OSCI sets service level objectives for fixing security vulnerabilities based on the security severity level and the affected product. We have defined the following timeframes for fixing security issues in our products:
Accelerated Resolution Timeframes
Extended Resolution Timeframes
These timeframes apply to all self-managed products of OSCI:
3. Critical Vulnerabilities
When a Critical security vulnerability is discovered by OSCI or reported by a third party, OSCI will:
It is important to stay on the latest bug fix release for the version of the product you are using (this is best practice).
The critical vulnerabilities resolution process does not apply to our Cloud products as these services are always fixed by OSCI without any additional action from customers.
4. Non-Critical Vulnerabilities
When a security issue of a High, Medium or Low severity is discovered, OSCI will aim to release a fix within the service level objectives listed at the beginning of this document. The fix may also be backported to Long Term Support releases, if feasible.
You should upgrade your installations when a bug fix release becomes available to ensure that the latest security fixes have been applied.
5. Customer Notification Process
When a security vulnerability is confirmed and a fix is being prepared or released, OSCI will notify affected customers through one or more of the following channels:
Notifications for Critical and High severity vulnerabilities will be sent as soon as a fix is available or, where disclosure is delayed for remediation purposes, within the SLO timeframe defined in Section 2.
For Medium and Low severity vulnerabilities, notifications will be included in regular release notes and changelogs.
6. Vulnerability Reporting
If you discover a security vulnerability in any OSCI product, please report it responsibly by contacting our security team at:
7. SLO Disclaimer
THE SLO TIMEFRAMES DEFINED IN THIS DOCUMENT ARE OBJECTIVES, NOT GUARANTEES. OSCI WILL USE COMMERCIALLY REASONABLE EFFORTS TO MEET THESE OBJECTIVES, BUT SHALL NOT BE HELD LEGALLY LIABLE FOR FAILURE TO MEET ANY SLO TIMEFRAME. THESE SLOs DO NOT CONSTITUTE A WARRANTY OF ANY KIND.
In no event shall OSCI be liable for any indirect, consequential, exemplary, incidental, special, or punitive damages arising from a security vulnerability, including but not limited to loss of data, loss of revenue, or loss of business, even if OSCI has been advised of the possibility of such damages.
8. Policy Changes and Retroactive Application
OSCI reserves the right to update or modify this Security Bug Fix Policy at any time. Changes to this policy will be published on our website and documentation portal.
| Scenario | Applicable SLO Version |
| Vulnerabilities reported before policy update | SLO in effect at time of initial report |
| Vulnerabilities reported after policy update | Updated SLO applies |
We will continuously evaluate our policies based on customer feedback and will provide any updates or changes on our documentation page.
9. Other Information
Severity level of vulnerabilities is calculated based on Severity Levels for Security Issues.
10. Contact Us
For security-related inquiries or to report a vulnerability:
5F, Narakium Bldg., 32, Teheran-ro 83-gil, Gangnam-gu, Seoul, Republic of Korea Tel.+82-2-516-0711 E-mail. atlassian_apps@osci.kr © Open Source Consulting Inc. All rights reserved.
5F, Narakium Bldg., 32, Teheran-ro 83-gil, Gangnam-gu, Seoul, Republic of Korea
Tel.+82-2-516-0711 E-mail. atlassian_apps@osci.kr
© Open Source Consulting Inc. All rights reserved.
