App Security

Static analysis runs on every commit; dependencies are scanned daily for known vulnerabilities.

All changes go through pull-request review with mandatory approvals and automated CI checks before merge.

Critical patches applied within 7 days; high within 30 days. Quarterly third-party penetration tests.