A secure platform needs more than good design. It must also act quickly and predictably when new threats appear. This page explains how Scale Computing watches for vulnerabilities and builds and tests fixes. It also covers how fixes reach your clusters, and how outside researchers can report issues.
Continuous vulnerability monitoring
Scale Computing actively monitors all components of SC//Platform™ for security vulnerabilities. That covers the code built in-house. It also covers the hand-picked open-source packages bundled into the SC//HyperCore™ HyperVisor and SC//Fleet™ Manager.
Because Scale Computing controls the full stack, you don’t wait for a downstream vendor to acknowledge an upstream issue. When a relevant CVE or other vulnerability is found, the same teams that wrote the code can assess its impact right away. They then build a fix and test it across the platform.
Agile development and rapid patching
The product, support, and engineering teams work closely, so information flows both ways. Customer feedback comes in and security fixes go out, without the delays common to stacks built from many vendors.
When a security exploit is found, the first priority is to protect your data. Scale Computing doesn’t rely on third-party companies or vendors to create or test patches. So it can build and release a patch for core concerns fast. It still checks that the full stack stays stable and works as a whole.
The release schedule shows this:
- SC//Fleet Manager gets weekly releases that include security patches for upstream packages and cloud-service fixes.
- The SC//HyperCore software gets monthly releases that include security patches, feature work, and platform improvements.
When the need is urgent, Scale Computing can build and ship critical out-of-band fixes. Updates roll across clusters in a controlled way, so security patches go on without disrupting running workloads.
Formal Incident Response Plan
Scale Computing follows a formal internal Incident Response Plan (IRP). It sets the steps taken for any detected vulnerability or incident:
- Identification — confirming the issue, scoping affected components, and assessing severity.
- Containment — limiting exposure while a fix is built and tested.
- Remediation — building, testing, and releasing patches through the standard signed update pipeline.
- Communication — giving affected customers guidance they can act on and, where it fits, public advisories.
All software patches and updates are built and shipped through secure, verified processes. These protect their integrity and authenticity, and let them roll out fast to customer sites. If a critical vulnerability or zero-day exploit appears, the internal security and engineering teams assess, patch, test, and release updates at once. You then get clear guidance on what is fixed, and on what action, if any, you need to take.
Vulnerability reporting
Scale Computing welcomes responsible vulnerability reports from outside researchers, customers, and partners. Each report is reviewed and dealt with promptly and openly.
You may find a possible vulnerability in the SC//HyperCore software, SC//Fleet Manager, or any other part of SC//Platform. If so, report it through Scale Computing’s official support channels. The internal security team will:
- Investigate all reported findings.
- Set the order of fixes by severity and impact.
- Keep affected parties informed as needed, including coordinated disclosure when warranted.
Responsible disclosure adds to the in-house work described above: monitoring, testing, and patching. Together they keep SC//Platform in step with new threats, and keep you informed as that work goes on.