隨記

Rationale

GitLab enforces strict SLAs for vulnerability remediation to maintain security posture. Unaddressed vulnerabilities increase the attack surface.

Requirements

Severity Remediation SLA Exception Process
Critical 7 days VP approval required
High 30 days Director approval
Medium 90 days Team lead approval
Low Next release No approval needed

Process

  1. Vulnerabilities are auto-detected by SAST, DAST, dependency scanning
  2. Issues are created automatically with severity labels
  3. Team must triage within 3 business days
  4. If exception needed, document justification in the issue
  5. Track metrics: mean-time-to-remediate, exception rate

Metrics

  • vulnerability_remediation_sla_compliance: % of vulnerabilities remediated within SLA
  • mean_time_to_remediate: Average days from detection to fix
  • exception_rate: % of vulnerabilities with approved exceptions

References