Release template
A security patch release plan for a fix to a vulnerability: severity assessed, the patch reviewed by the security owner, the fix verified against the report, dependencies scanned, and disclosure planned.
Overview
A vulnerability fix has two audiences: the systems that need the patch, and the customers who need to know whether they should act. A good plan covers both, and records how serious the issue was.
This template is the built-in Security patch template in Atlas. It creates a release of the Patch type named Security update followed by its version, bumps the patch number from the latest released version, sets the target three days after the start, and plans deployments to Staging and Production.
Every one of its five checks is required, so the patch cannot be moved to Released until the severity is recorded, the security owner has reviewed it, and the disclosure is planned.
What is included
Severity assessed and recorded, patch reviewed by the security owner, fix verified against the reported issue, dependencies scanned after the patch, and disclosure and customer notice planned.
The target date is set three days after the start, so an open patch is visible as soon as it slips.
Planned deployments to Staging and Production.
The patch number is bumped from the latest released version, so 2.4.1 becomes 2.4.2.
Headings for Summary, Who should update, and Credits, so the reporter of the issue is acknowledged.
How to use it
Use the template button on this page, or start a release at /releases/new and choose Security patch.
Record the severity, add the fixing task to the scope, and request sign-off from the security owner.
Reproduce the reported issue against the patched build in Staging, then scan dependencies again.
Record the Production deployment, move the release to Released, and send the planned customer notice.
FAQ
Ready when you are
Atlas is the all-in-one work OS: tasks, projects, CRM, contracts, HR, and automation on one shared record, with a governed AI assistant. Start free.