Vulnerability and Threat Management Procedure
linkhaus, LLC · Effective November 4, 2026 · Owner: Company owner · Review: At least annually
This policy establishes operating requirements. Implementation evidence, configuration records, and completed reviews are maintained separately; publication alone is not proof that every control has been implemented or audited.
Ownership and intake
The owner maintains the vulnerability register for Linkhaus code, dependencies, container images, cloud settings, and administrative systems. Reports may arrive through shie@linkhaus.ai, provider alerts, dependency advisories, scan results, or operational monitoring. Each finding must record the affected asset, severity, evidence, responsible person, status, and target remediation date.
Detection and assessment
Relevant provider and dependency security notifications must be enabled and reviewed. Dependency and vulnerability scans must run before material releases and at least monthly for active systems. Configuration changes must be reviewed for public exposure, excessive permissions, and secret leakage. Additional testing, including independent penetration testing where warranted, must be selected according to risk and scope. Testing must be authorized and avoid harm to customer data or third-party services.
Remediation
Assess exploitability, exposure, data sensitivity, and operational impact. Actively exploited issues and exposed credentials require immediate triage and containment. Other findings must receive a risk-based deadline approved by the owner. Apply patches, configuration changes, or documented compensating controls, then re-test before closure. Deferred fixes require a recorded justification, safeguards, and review date.
Evidence and follow-up
Retain scan reports, assessment notes, remediation records, exceptions, and re-test results with restricted access. Review open findings at least monthly and the procedure annually. Suspected exploitation triggers the Incident Response Policy. Publication of this procedure is not a claim that a penetration test, continuous monitoring service, or particular scanner has already been deployed.
Exceptions require owner approval, documented safeguards, and a review date. Contact: shie@linkhaus.ai.