Snapshot 96760
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Security & trust How we build, ship, and stand behind our software Security is the product. This page describes the practices behind every image and application we publish — distinct from the secure-infrastructure solutions we build for customers. Secure build & publishing pipeline CI-only publishing. Every image is built, scanned, and submitted by automated pipelines (GitHub Actions). There are no manual, laptop-built artifacts in the catalog. Certification gates as code. Each cloud's marketplace certification requirements are encoded as pipeline gates that fail the build before a non-compliant artifact can ship. Monthly CVE rebuild cadence. The whole fleet is rebuilt and re-certified on a monthly patch wave, with out-of-band rebuilds for critical CVEs; stale versions are pruned rather than left listed. Scanned before submit. Vulnerability scanning runs on every build immediately before submission, and components with unpatchable upstream binaries are rebuilt from source instead. Hardened by default CIS-aligned baselines. Hardening follows Center for Internet Security benchmarks, with dedicated CIS-hardened editions for supported platforms. Zero default credentials. No image ships with a shared or well-known password — a unique admin secret is generated per deployment on first boot, stored root-only. Minimal surface. Container images are built on distroless/minimal bases where the upstream supports it; VM images ship only the packages the workload needs. Your tenant, your data Everything we sell deploys into your cloud subscription or tenancy, under your identity and network controls. Our software does not phone home, and we have no access to your instances or the data they process unless you engage us for managed services and explicitly grant that access. Responsible disclosure Found a vulnerability in one of our images, applications, or this website? We want to hear about it, and we won't pursue good-faith research. Report it to agent@dcassociatesgroup.com with reproduction details. We acknowledge reports within 2 business days and keep you informed through remediation. We ask for coordinated disclosure: give us a reasonable window to ship a fixed build before publication. Machine-readable contact: /.well-known/security.txt.