A window into our security processes: introducing the Determinate Secure Packages CVE Remediation Dashboard

Today, we’re launching the Determinate Secure Packages CVE Remediation Dashboard at security.determinate.systems: a public, continuously updated view of the Common Vulnerabilities and Exposures (CVE) records that Determinate Secure Packages tracks, and the fixes we ship for them. It’s the work our security team does every day, on a page, updated hourly.

Determinate Secure Packages is a complete supply chain solution for Nix: a curated set of packages, cryptographically signed and built on SOC 2 Type II infrastructure, with full coverage in FlakeHub Cache, optional builds that meet Federal Information Processing Standards (FIPS) for regulated environments, and Software Bills of Materials (SBOMs) generated by FlakeBOM and checked against your policies by FlakeAudit.

Vulnerability remediation is one major part of that, and it comes with one of our most important commitments: a service-level agreement (SLA) for every severity, with critical CVEs fixed within 7 days of disclosure. The dashboard shows that work as it happens, so you can see what you’d be taking on without us.

Expand image

Behind the scenes, we run a purpose-built pipeline: scanners that watch the National Vulnerability Database (NVD) and Open Source Vulnerabilities (OSV) for every package we cover, tracking processes that run a separate clock for each advisory in each supported release, automation that patches, rebuilds, validates, and signs the affected packages, and FlakeBOM and FlakeAudit to generate and audit the SBOMs that document what shipped. We run all of it at a scale worthy of the task:

• More than 10,000 packages in the covered set, across both the rolling release and every supported stable release.
• Over 1,000 CVEs tracked at any time, each on its own clock in each release it affects.
• SLAs of 7, 15, 45, and 90 days for critical, high, medium, and low severity CVEs, respectively, with the clock starting at disclosure.
• 100% cache coverage for packages in the covered subset: every package for every supported release is in FlakeHub Cache, so a package update is always a download rather than a rebuild.

The numbers up top

Three cards head the page, and each one links to the full list of CVEs behind it:

• Fixed in the last 30 days and the last 7 days are the CVEs we patched, rebuilt, and shipped in those windows.
• In progress is what our team is working on right now.

As I write this, the fixes we shipped in the past month number nearly 2,000. Every one of those is a vulnerability that our scanners caught, our team triaged, and our pipeline patched, rebuilt, validated, and shipped for every release we support. Every one is also a way into your systems that’s now closed.

Expand image

The CVE tracker

The centerpiece is a chart of the CVEs we’re tracking right now. Each dot is one CVE, and the chart tells you three things about it:

• Severity is the row, and the color. The lanes are critical, high, medium, and low, each labeled with the SLA we hold ourselves to for that level: 7, 15, 45, and 90 days, as in our SLA documentation.
• The day the fix shipped is the position along the date axis, which covers the last 30 days and ends at today. A dot’s place on that axis is the day the rebuilt package reached you.
• Status is the fill. A filled dot is a fix that shipped. A hollow dot sits in the band past today’s line, where the CVEs we’re working on right now live.

Fixes arrive in batches, because a single CVE is filed once per release it affects and because upstream advisories tend to cluster. Rather than piling dots on top of each other, the chart stacks each day’s CVEs into a column, and a day with more than 30 wraps into columns beside it. Every dot gets drawn, so a busy week reads as a wide block instead of a smear.

Expand image

Dig in

Hover over a dot for the essentials, and click it to see everything the dashboard knows about that CVE: every release we track it in, when each fix shipped, the description, and links to the same CVE in NVD and OSV.

Expand image

The chips above the chart filter by severity and status, and your selection goes into the URL, so a filtered view is a link you can share. This one, for example, shows the critical and high CVEs our team is working on right now:

We designed the color palette to be friendly to people with color blindness, and no status rides on color alone: a fix that shipped is a filled dot, work in progress a hollow one. And of course we wouldn’t dare ship without dark mode.

The work at a glance

Below the tracker, three charts sum up the same CVEs: the share at each severity, how much of the work is done, and how long each fix took, counting from the moment work on it began. That last chart is the one we’re proudest of. As I write this, we shipped 74% of the fixes from the last 30 days on the same day we started them, and 85% within a day.

Expand image

Where the data comes from

The dashboard is a window onto the tracker our security team works with every day, not a separate report that we generate. Every hour, it pulls every tracked issue that’s open or was fixed in the last 30 days and redraws the page you see. The CVE records themselves come from NVD and OSV.

Why we built it

One of the core goals of Determinate Secure Packages is to let you use Nix to maximal effect without running your own CVE program for Nixpkgs. Nixpkgs is enormous and upstream advisories arrive continuously, so staying on top of them for even a few hundred packages is a full-time job. Hand that job to us and you free up your engineers’ time, attention, and budget for the software you’re actually building. Our team does the work on the clock and ships you signed builds from SOC 2 Type II infrastructure with full coverage in FlakeHub Cache.

But it’s been hard to convey the sheer volume and relentlessness of that work. The dashboard exists to make it visible. Every dot is a vulnerability that somebody had to find, fix, rebuild, and ship, and every one of them is a way you could have been compromised.

Get started

Go explore the dashboard. Filter it, click around, and send someone a link.

If you’d like our team making fixes like these for you, drop us a line at sales@determinate.systems to discuss terms or schedule a demo. Once you’ve gained access, our documentation covers how the SLA works, which packages we cover, and how to switch a flake over to Determinate Secure Packages with a one-line change:

{
 inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
 inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-26.05/0";
}