Security advisories.

Every confirmed vulnerability in Holy is fixed or mitigated within a window set by its severity, counted in calendar days from triage — the point at which we confirm the issue and assign a severity:

• ·Critical — within 15 days. Any exposure of one church’s data to another, any authentication bypass, and any flaw that could move or misattribute money is critical, whatever its score.
• ·High — within 30 days.
• ·Medium — within 60 days.
• ·Low — within 90 days, or accepted with a written rationale.

Severity is judged by the impact on the confidentiality and integrity of church data first, then availability, using CVSS as a guide. A critical issue can only be fixed or mitigated, never accepted as a risk. A suspected personal-data breach also follows our breach procedure: affected churches are told without undue delay and within 72 hours.

We publish an advisory for every critical or high vulnerability that could have affected customer data or accounts, once the fix has shipped. Each advisory says what was affected, what an attacker could have done, for how long, when it was fixed, and whether a church needs to do anything. Advisories are dated and never removed; a correction is added as a dated note.

No security advisories have been published.

Please follow our vulnerability disclosure policy and email security@holyplatform.com. We acknowledge reports within 3 business days.