Vulnerability Management Policy

1. Scope

This policy applies to all Blueprint production systems, web and mobile applications, third-party dependencies, and infrastructure components including cloud services, APIs, and development tooling.

2. Vulnerability Identification

Blueprint identifies vulnerabilities through the following methods:

• Dependency scanning — npm audit run on every build and prior to every production deployment to detect known vulnerabilities in third-party packages
• Security advisories — Active monitoring of GitHub Dependabot alerts, CVE databases, and security advisories for all frameworks in use (Next.js, Expo, NestJS, Supabase)
• Code review — Security-focused code review prior to merging changes that affect authentication, data access, or payment flows
• OWASP Top 10 — Periodic review of all application surfaces against the OWASP Top 10 vulnerability categories
• Third-party notifications — Security notifications from Vercel, Supabase, Plaid, Stripe, and other service providers

3. Vulnerability Severity Classification

Identified vulnerabilities are classified by severity using the Common Vulnerability Scoring System (CVSS):

4. Patching SLA (Service Level Agreement)

Blueprint commits to remediating identified vulnerabilities within the following timeframes from the date of identification:

5. End-of-Life (EOL) Software Management

Blueprint actively monitors and manages end-of-life software across all systems:

• Runtime monitoring — Node.js, React Native/Expo, and all runtimes are maintained on actively supported LTS versions. EOL versions are upgraded within 30 days of the official EOL date
• Framework tracking — Next.js, NestJS, and Expo SDK versions are tracked against their official support schedules. Upgrades are planned in advance of EOL dates
• Dependency review — Third-party npm packages are reviewed quarterly for EOL status, abandonment, or lack of security support
• Cloud infrastructure — Infrastructure managed by Vercel and Supabase is maintained by those providers on supported versions; Blueprint monitors provider announcements for deprecation notices
• Policy review — EOL management practices are reviewed and updated at least annually

6. De-provisioning and Access Termination

Blueprint maintains automated and procedural controls to ensure access is promptly revoked when no longer needed:

• Upon termination or role change, access to all systems (Supabase, Vercel, GitHub, Stripe, Plaid, cloud services) is revoked within 24 hours
• API keys and secrets held by departing personnel are rotated immediately
• OAuth tokens and service credentials are invalidated upon departure
• A de-provisioning checklist is completed and documented for each access termination event
• Third-party integrations are reviewed upon any personnel change to ensure no residual access remains

7. Zero Trust Architecture

Blueprint's infrastructure is built on zero trust principles — no implicit trust is granted based on network location or prior authentication:

• Every API request is authenticated and authorized independently, regardless of origin
• Row-level security (RLS) enforced at the database layer — no request can access data without explicit authorization
• Service credentials are scoped to the minimum permissions required and are never shared across services
• All inter-service communication is encrypted in transit via TLS 1.2+
• Production secrets are stored in encrypted secrets management systems and never embedded in code

8. Policy Review

This policy is reviewed at least annually. All identified vulnerabilities and remediation actions are tracked and documented. For questions, contact us at blueprintappai@outlook.com.