Security is built into everything we ship

Our Commitment

Bigstack is committed to delivering software that enterprise customers can trust. Security is not a final step in our development process, it is a foundational requirement embedded from the earliest stages of product design through to release and ongoing maintenance.

This document provides a high-level overview of the practices, standards, and processes that govern how we build and maintain CubeCOS. It is intended for corporate compliance, procurement, and executive audiences conducting security due diligence.

This page was last reviewed in Q2 2026. For the most recent security advisories, see the Security Advisories page.

How We Design for Security

Security requirements are defined before development begins. For every significant feature or system change, our engineering teams conduct a structured review to identify potential risks, define controls, and document decisions before a single line of code is written.

We use a set of widely recognized industry frameworks as practical references to guide our development decisions, inform our testing approach, and improve our security practices over time, including:

• OWASP Top 10 - The industry-standard benchmark for web application security risks
• MITRE CWE Top 25 - the most critical software weakness identified by the global security community
• OpenSSF Scorecard - an open-source security health standard maintained by the Linux foundation
• NIST Secure Software Development Framework (SSDF)

Adhering to these frameworks gives our customers confidence that the CUBE platform has been developed in line with the recognized benchmarks of regulators, auditors and enterprise security teams worldwide.

How We Test Our Software

We apply multiple, independent layers of security testing throughout the development process. No software is released without passing these gates:

• Code-level security analysis examines our source code for known vulnerability patterns before the software is ever run, identifying weaknesses early when they are least costly to fix.
• Runtime security testing exercises our web-facing systems in a live environment, simulating the techniques an attacker might use to probe for weaknesses in running applications.
• Dependency and component scanning reviews every third-party library and open-source component included in our software against global vulnerability databases, ensuring we are not shipping known-vulnerable components to customers.
• Secrets and credential scanning prevents sensitive credentials from being accidentally embedded in our codebase.

Any finding of significant severity blocks the release from proceeding until it is resolved.

Supply Chain Security

Bigstack takes the integrity of our software supply chain seriously. We maintain a complete inventory of every software component included in each release — known as a Software Bill of Materials (SBOM). The SBOM of each release are cryptographically signed, allowing customers to verify that what they receive is exactly what we built and has not been tampered with in transit.

SBOMs are published alongside each release and downloadable from the Releases page

Vulnerability management

When security vulnerabilities are identified whether through our own testing, customer reports, or external security research. These alerts are routed to the AppSec team that will triage, evaluate, and provide prompt mitigation for the vulnerabilities.

Critical and High severity issues are addressed through out-of-band security releases, independent of our regular release schedule. Affected customers are notified with details of the issue and the recommended course of action.

Security fixes are published as security advisories on the Bigstack Security Advisories page. You can view the published advisories on the Advisories page, or subscribe to advisory notifications via the repository mailing list to receive updates on new releases. 

Responsible disclosure

Bigstack operates a Responsible Disclosure Program, providing a clear and safe channel for external security researchers to report potential vulnerabilities. We commit to acknowledging all reports promptly, providing a resolution timeline, and coordinating disclosure in a manner that protects our customers. For details on our responsible disclosure process, refer to our Vulnerability Disclosure Policy.

Security reports can be submitted to: security@bigstack.co. 

People and Accountability

Security is a shared responsibility across our organization. Policy ownership is held by Engineering leadership, with annual reviews to ensure our practices remain current with the evolving threat landscape.

Summary

Bigstack builds with security as a foundational discipline. Our practices span the full software lifecycle from secure design and rigorous testing, to supply chain integrity and structured vulnerability response. We align to globally recognized frameworks, and provide enterprise customers with the transparency and documentation needed to fulfill their own compliance and due diligence obligations.