CISA Secure by Design Pledge Alignment

Goal 2 — Default passwords

The platform does not ship with default credentials. New workspaces force a credential set on first sign-in; service accounts are provisioned with rotation policies.

Goal 3 — Reducing entire vulnerability classes

• Prefer memory-safe application languages where practical.
• Database access uses prepared statements and typed data access to reduce injection risk.
• Browser security headers, anti-forgery controls, and careful output encoding to reduce common web risks.
• Automated security checks (static analysis, secret detection, dependency review) on every change.

Goal 4 — Security patches

Critical security patches are deployed within 7 days; high-severity within 30 days; medium within 90 days. Customer-facing security patches are documented in the changelog with the affected version range.

Goal 5 — Vulnerability disclosure policy

We operate a published vulnerability disclosure policy with safe-harbor for good-faith research. See /security/responsible-disclosure and /.well-known/security.txt.

Goal 6 — CVE assignment

Security issues that meet CVE criteria are submitted for CVE ID assignment with accurate severity scoring and impact descriptions, regardless of whether they are externally reported or internally discovered.

Goal 7 — Evidence of intrusions

Customers can obtain audit logs covering authentication, administrative actions, and data-access events. We document log retention and customer access methods on the Security overview page.