Vulnerability & Patch Log (Evidence 8.2.1)

Owner: Dr Simon Chapman (CTO) Reviewed and Approved By: Dr Serena Haywood (SIRO) Last SIRO Review: March 2026 Next Review: June 2026 Last Updated: 10 April 2026

Threat intelligence is sourced from NCSC Early Warning, GitHub Security Advisories, and OWASP and is reviewed as a standing item in our quarterly security meeting. Significant threat intelligence events are recorded in this log.

Monitoring Tools: pip-audit, ggshield (via pre-commit), GitHub Dependabot, CodeQL.

1. Active Vulnerability Exceptions (Open & Ignored)

Current Status: 1 active exception. Monitoring for upstream fix.

Our security scanning pipeline otherwise operates with zero vulnerability exceptions. All dependencies are monitored in real-time and any new vulnerabilities will cause immediate CI/CD pipeline failure.

Previously Active Exceptions (Now Resolved - January 2025)

The following vulnerabilities were previously silenced but have been fully remediated through dependency architecture improvements:

2. Recently Remediated Patches (Closed)

Verified history of security updates applied. Real-time evidence is available in the CheckTick GitHub repository under the dependencies label and closed issues.

3. Automation & Triage Process

1. Continuous Auditing: Our Security Scan GitHub Action runs on every Push, Pull Request, and daily at 06:00 UTC.
2. Hard Block on Production: If pip-audit detects any vulnerability (Critical, High, Medium, or Low), the build fails and deployment is automatically blocked. No exceptions are configured.
3. Isolated Security Tooling: Security scanning tools (ggshield, pre-commit) run in isolated environments managed by pre-commit, preventing their dependencies from constraining production packages.
4. Zero-Exception Policy: Since January 2026, we maintain a zero-exception policy for vulnerability scanning. This ensures immediate visibility and remediation of any new vulnerabilities.
5. Endpoint Sync: Developers are required to run poetry install locally to synchronize their development environment with the latest patched versions in poetry.lock, preventing 'version drift' between local and production environments.

4. Architecture Improvements (January 2026)

Key Change: Separated security scanning tool dependencies from application runtime dependencies.

Before:

• Security tools (ggshield) were installed via Poetry alongside application dependencies
• Security tools pinned critical dependencies (cryptography, urllib3) to outdated versions
• Required maintaining an exception list of 10+ vulnerabilities
• Could not update vulnerable dependencies without breaking security tools

After:

• Security tools run in isolated pre-commit environments
• Production dependencies are free to update immediately when patches are released
• Zero vulnerabilities in production dependency tree
• Zero exceptions required in CI/CD pipeline
• Improved security posture and maintainability

This architectural change represents a significant improvement in our security monitoring capability while simultaneously reducing our vulnerability exposure.

5. CDN Artifact Handling & Integrity (January 2026)

Change: Updated automated CDN library refresh workflow to use npm pack as the canonical source for packaged JavaScript assets and to compute SRI from the package contents.

• Reason: Downloading files directly into the repository root from third-party CDNs caused temporary artifacts to remain after workflow runs (triggering security scanners such as CodeQL). Using npm pack ensures the registry is the authoritative source and the artifact bytes are reproducible.
• What changed: The update-cdn-libraries GitHub Action now:
  • Runs npm pack <pkg>@<version> in a temporary directory
  • Extracts the tarball, finds the minified asset, computes SHA-384 SRI from the file bytes, and atomically moves the asset into checktick_app/static/js/
  • Cleans up temporary files and directories using traps to avoid leaving files in the repository
• Outcome: SRI values are computed from the exact npm package bytes; temporary files no longer appear in the repo root; CodeQL false-positives reduced.

Evidence: PR #155 updates the workflow and documentation to reflect this change and updates axe-core to 4.11.1 with the new SRI hash.