Security & Compliance
Vulnerability management
ArkCloud runs automated dependency, secret and container checks on its main branch. They do not yet gate what is released to production, and there are no published patch timelines. This page describes what exists and how to report a vulnerability.
Written for: Security reviewers · Researchers
Reporting a vulnerability
Email [email protected] with a description, the affected URL or component, steps to reproduce, and how to reach you. Please do not access other organisations' data, degrade the service, or test against accounts you do not own.
Automated checks
| Field or control | What it means |
|---|---|
| Dependency audit | npm audit of production dependencies at high severity and above. |
| Secret scanning | gitleaks over the full repository history. |
| Infrastructure-as-code | tfsec over the Terraform files (which describe a cloud deployment that is not in use). |
| Container image scan | Trivy over the Docker images the workflow builds; critical findings fail the run, high findings are reported only. Production does not run those images - it runs the application's dependencies installed directly on its host - so this scan does not cover what production runs. |
Patching
Known findings in third-party dependencies are tracked in an internal register. Its last scan was taken against the container images rather than the dependencies production runs, and its monthly review, due on 27 September 2026, did not take place. At least one high-severity dependency finding is open, with no fixed version published to npm.
Application dependencies are updated by hand as part of ordinary releases. The production host's operating system, database, runtime and tunnel software are patched manually; there is no scheduled patch cycle and no severity-based deadline yet. A monthly patch check is proposed in ArkCloud's draft risk management plan.