Vulnerability and Threat Management Procedure

Patching

• Operating system, browser and runtime (Node.js) updates are applied automatically or within 14 days of release; critical security patches within 72 hours.
• Software dependencies are checked with npm audit before every release; high and critical findings are fixed before deploy.

Secure development

• Secrets are excluded from source control by ignore rules that are verified.
• Changes are tested end-to-end before reaching production.
• Only official APIs are used; no scraping or unofficial endpoints.

Threat monitoring

Microsoft Defender alerts, TikTok and Cloudflare security notices are reviewed by the Security Owner as they arrive.

Approved by Carlos Henrique Ferreira Guimaraes, Managing Partner, on November 6, 2026.