Perryscope.ai
PlatformDocsRoadmapCompare
Request demo
Perryscope.ai

Self-hosted sensitive-data security for the AI era.

ProductsSecret SecurityPrivacy SecurityAI Guardienne
PlatformArchitectureSecurity modelGovernance syncObservability
DevelopersDocumentationAPI referenceCLIWebSocket eventsGet started
CompanyRoadmapCompareFAQSupportContactPrivacy policyTerms
© 2026 Perryscope. Flexible enterprise licensing.100% self-hosted · zero third-party calls
Documentation
StartGetting startedConfigurationDeployment
ScanningScanning modesFindings & workflowValidationPrivacy scanningAI Guardienne
IntegrateCLIAPI referenceWebSocket eventsGovernance sync
ReferenceSecurity modelDNS change runbookTransactional email deliveryMonitoring & alertingDisaster recovery & failoverSite recovery & backupsSecrets: leak prevention & rotationDependency & patch automation
Docs / Reference

Dependency & patch automation

Stale software is expanded attack surface, whether it's a plugin, an npm package, a base image, or a CI action. Every dependency Perryscope ships or builds with is kept current through automated update PRs and continuous SCA scanning — not a manual, occasional review.

Automated update coverage

SurfaceMechanism
App packages (npm)Dependabot version updates open PRs daily for this repo's package.json, grouped by production vs. development dependencies.
CI actionsDependabot tracks the github-actions ecosystem weekly, so pinned action versions in .github/workflows don't go stale.
Base images & OS packagesBackend/service repos pin base images by digest and run Dependabot's docker ecosystem plus scheduled OS-package rebuilds; this static site ships no container image.
SDKs & provider librariesTracked as regular package-manager dependencies in whichever repo consumes them — no SDK is vendored or hand-copied out of band.
Infrastructure dependenciesTerraform/IaC module and provider versions are pinned and updated through the same automated-PR pattern in their owning repo.

Continuous scanning

  • The Dependency scan workflow runs npm audit --audit-level=high on every push to main, every pull request, and weekly on a schedule — see .github/workflows/dependency-scan.yml.
  • Dependabot alerts provide continuous SCA coverage against the GitHub Advisory Database for every tracked ecosystem, independent of the CI schedule.
  • A failing audit blocks the PR check; it does not silently pass.

Remediation SLAs

SeverityRemediation SLA
CriticalPatch or mitigate within 48 hours of the advisory becoming known.
HighPatch within 7 days.
MediumPatch within 30 days, or the next regular release cycle if sooner.
LowBundled into routine dependency PRs; no standalone SLA.

Visibility

  • Dependabot alerts and open update PRs are the live source of truth for patch status — visible to engineering and security without a separate spreadsheet.
  • Update PRs are labeled dependencies (and ci for Actions) so they're filterable in the PR queue.
  • A repo admin must enable Dependabot alerts and Dependabot security updates under Settings → Code security — the config files here define update behavior once that's on.

Source: .github/dependabot.yml · .github/workflows/dependency-scan.yml

← Secrets: leak prevention & rotationDocumentation home →