What is scanned
| Layer | Tool | When |
|---|---|---|
| Application code | CodeQL static analysis | Every pull request and every push to the main branch; a new High alert blocks the merge |
| Secrets | GitHub secret scanning with push protection, and Gitleaks | Every push; Gitleaks also runs a weekly full-history scan |
| Dependencies | Production dependency audit and SBOM; full dependency audit; Dependabot alerts and update pull requests | Every change; the full audit daily; Dependabot continuously and weekly |
| Container images | Grype, on the application image, the database image and the malware scanner image | Daily for the application and database images, weekly for the malware scanner image, and on every relevant change; a pull request fails on a High or Critical finding that has a fix |
| Public web surface | OWASP ZAP passive baseline | Weekly |
Every scheduled scan opens an issue when it fails, so a broken scan cannot pass unnoticed. CodeQL and image scan findings are kept in GitHub code scanning; the dependency audit and ZAP reports are kept as workflow artifacts. Image scan artifacts are kept for 90 days, CodeQL results and SBOMs for 30 days.
How quickly findings are fixed
These targets were accepted by the system owner on October 11, 2026, and take effect when the policy set is signed. They are calendar days, counted from the earliest of the vendor's patch, public disclosure, or the first Truenote scan that reports the finding:
| Priority | Trigger | Fix within |
|---|---|---|
| P0 emergency | In the CISA Known Exploited Vulnerabilities catalog, or exploited in the wild | 3 days |
| P1 critical | CVSS 9.0 or higher | 7 days |
| P2 high | CVSS 7.0 to 8.9 | 14 days if internet-reachable and likely exploitable, otherwise 30 days |
| P3 medium | CVSS 4.0 to 6.9 | 90 days |
| P4 low | CVSS 0.1 to 3.9 | 180 days |
| Vendor update | Any security update to a base image, runtime or dependency | 30 days; 7 days if it fixes a P0 or P1 finding |
| No fix available | The vendor has not released a fix | Compensating control within 30 days, a vendor check at least monthly, and a tracked item until it is fixed |
A finding still open after 192 days is recorded as an accepted vulnerability with an explanation and an approver. The timelines draw on CISA BOD 26-04, the FedRAMP vulnerability guidance and PCI DSS v4.0.1 requirements 6.3.3 and 11.3; where they differ, the shortest deadline applies.
Where things stand
As of October 11, 2026, the scans of the application, database and malware scanner images showed no open High or Critical finding with an available fix, and none of their open findings is in the CISA Known Exploited Vulnerabilities catalog. A fix in a newly built image reaches a running service when that service is redeployed. Findings that do not apply to Truenote, because the affected library is not loaded or the affected feature is not used, were dismissed with a written reason, a date and a re-check trigger. The remaining open findings have no vendor fix yet; they are checked monthly and fixed by redeploying when the vendor ships a fix.
Monthly reporting starts in November 2026.