Sign in

Nuxt 2 SLA

When a Security Vulnerability or Compatibility issue is reported to Support, Company will respond to such report by creating an Issue for resolution. Each Issue will be resolved according to Company’s standard operating procedures, and in accordance with the Service Level correlated with Issue’s Common Vulnerability Scoring System v3 (CVSS) score.

 

The Service Levels are defined as:

 

P1 Issues

  1. Categorized by High & Critical CVSS scores (7.0-10.0) and any of the following properties:
    1. Public Disclosure of CVE through MITRE.
    2. Impact or attack vectors not isolated to a single implementation.
    3. Irreparable data loss, including data corruption, network traffic tampering, etc.
    4. Critical application functionality degradation with no known workaround or mitigation strategy.
  2. Resolution Guarantees:
    1. Acknowledgement of report within 24 hours.
    2. Investigation into report within 48 hours.
    3. Company shall release Update within 14 days.
    4. Company must immediately release Update upon verification.

P2 Issues

  1. Categorized by a Medium CVSS score (4.0-6.9) and any of the following properties:
    1. Public Disclosure of CVE through MITRE.
    2. Impact or attack vectors not isolated to a single implementation.
    3. Irreparable data loss, including data corruption, network traffic tampering, etc.
    4. Critical application functionality degradation without a viable workaround or mitigation strategy.
  2. Resolution Guarantees
    1. Acknowledgement of report within 24 hours.
    2. Investigation into report within 48 hours.
    3. Company shall release Update within 21 days.
    4. Company must immediately release Update upon verification.

P3 Issues

  1. Categorized by Medium, High & Critical CVSS scores (4.0-10.0) and any of the following properties:
    1. Impact / attack vector not isolated to a single implementation.
    2. Significant data loss, including data corruption, network traffic tampering, etc.
    3. A potential for critical application functionality degradation with no known workaround or mitigation strategy.
  2. Resolution Guarantees
    1. Acknowledgement of report within 24 hours.
    2. Investigation into report within 5 days.
    3. Company shall release Update within 21 days.
    4. Company must immediately release Update upon verification.

P4 Issues

  1. Categorized by any of the following properties:
    1. A Low CVSS score (0.1-3.9).
    2. A low likelihood of impact / attack vector not isolated to a single implementation.
    3. Minor recoverable data loss.
    4. General application functionality degradation that requires an inconvenient workaround or mitigation strategy.
  2. Resolution Guarantees
    1. Acknowledgement of report within 1 business week.
    2. Investigation into report within 14 days.
    3. Company shall make commercially reasonable efforts to release an Update within 60 days.
    4. Company must immediately release Update upon verification.

In the event an extraordinary Issue cannot be resolved given its level of effort and resolution window, Company will continue to communicate updated expectations at the Investigation Progress Update interval.