> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pensionsportal.ie/llms.txt
> Use this file to discover all available pages before exploring further.

# Vulnerability Management

> How PensionsPortal.ie identifies, assesses, and remediates vulnerabilities in dependencies and application code.

PensionsPortal.ie uses a layered approach to vulnerability management, combining automated scanning at build and CI time with periodic manual reviews.

## Dependency Scanning

### npm audit

`npm audit` is executed as part of the CI pipeline on every pull request and on a scheduled basis against the production branch. It checks all direct and transitive dependencies against the npm advisory database.

```bash theme={null}
npm audit --audit-level=high
```

High and critical severity findings block the CI pipeline. Moderate findings are tracked and remediated within the SLAs defined below.

### Dependabot / Automated Updates

Automated dependency update pull requests are configured to:

* Open PRs for security patches automatically
* Group minor/patch updates to reduce PR noise
* Require CI passage before any dependency update is merged

### Runtime Dependency Inventory

Key dependencies and their security posture:

| Package             | Purpose          | Notes                                                        |
| ------------------- | ---------------- | ------------------------------------------------------------ |
| `next`              | Framework        | Kept up-to-date; Next.js security advisories monitored       |
| `next-auth`         | Authentication   | Auth.js v5; actively maintained                              |
| `drizzle-orm`       | ORM              | Parameterised queries prevent SQL injection by design        |
| `bcryptjs`          | Password hashing | Standard bcrypt implementation                               |
| `@sentry/nextjs`    | Error monitoring | Detects runtime errors in production                         |
| `@ai-sdk/anthropic` | AI integration   | No user data sent to Anthropic beyond session-scoped prompts |

## Vulnerability Severity SLAs

| Severity | Target Remediation Time           |
| -------- | --------------------------------- |
| Critical | 24 hours                          |
| High     | 7 days                            |
| Moderate | 30 days                           |
| Low      | Next scheduled maintenance window |

<Warning>
  Critical vulnerabilities in authentication, session handling, or data encryption components are treated as incidents and follow the [Incident Response](/operations/incident-response) process.
</Warning>

## Application-Layer Security Testing

Beyond dependency scanning, security is verified at the application layer:

* **Security regression tests** (`src/tests/api/security.test.ts`) run in CI on every PR
* Tests verify that API routes do not expose connection strings, stack traces, or environment variable names in error responses
* New API routes require a corresponding security review checklist item in the PR template

## Infrastructure Scanning

| Layer             | Control                                                                           |
| ----------------- | --------------------------------------------------------------------------------- |
| Vercel deployment | Vercel's own dependency scanning and build-time checks                            |
| Cloudflare WAF    | Managed rulesets updated automatically by Cloudflare                              |
| Neon PostgreSQL   | Managed service — Neon applies PostgreSQL patches; major version upgrades planned |

## Disclosure and Patch Process

1. Vulnerability discovered (automated scan, researcher report, or vendor advisory)
2. Severity assessed against CVSS and business context
3. Patch or mitigation implemented on a feature branch
4. CI pipeline + security test suite run
5. Deployed to preview environment for validation
6. Merged to `main` and deployed to production
7. Audit log entry or incident ticket created documenting the remediation

## Responsible Disclosure

Security researchers who discover vulnerabilities in PensionsPortal.ie are asked to disclose responsibly via the contact details in the application's security policy. We commit to acknowledging reports within 2 business days and providing a remediation timeline within 7 days.