A window into our security processes: introducing the Determinate Secure Packages CVE Remediation Dashboard

Today, we’re excited to launch the Determinate Secure Packages CVE Remediation Dashboard at security.determinate.systems: a public, continuously updated view of every Common Vulnerabilities and Exposures (CVE) record that Determinate Secure Packages is currently tracking, the deadline our service-level agreement (SLA) gives each one, and whether we fixed the CVE within that SLA.

Determinate Secure Packages is a complete supply chain solution for Nix: a curated set of packages, cryptographically signed and built on SOC 2 Type II infrastructure, with full coverage in FlakeHub Cache, optional builds that meet Federal Information Processing Standards (FIPS) for regulated environments, and Software Bills of Materials (SBOMs) generated by FlakeBOM and checked against your policies by FlakeAudit.

Vulnerability remediation is one major part of that, and it comes with one of our most important commitments: an SLA for every severity, with critical CVEs fixed within 7 days of disclosure. The dashboard surfaces that work as it happens, updated hourly, so you can see every fix, every deadline, and every outcome in near-real time.

Expand image

Behind the scenes, we have a purpose-built pipeline to handle all of this: scanners that watch the National Vulnerability Database (NVD) and Open Source Vulnerabilities (OSV) for every package we cover, tracking processes that run a separate clock for each advisory in each supported release, automation that patches, rebuilds, validates, and signs the affected packages, and FlakeBOM and FlakeAudit to generate and audit the SBOMs that document what shipped. And we run all of it at a scale worthy of the task:

• More than 10,000 packages in the covered set, across both the rolling release and every supported stable release.
• Over 1,000 CVEs tracked at any time, each on its own clock per release, with all of them fixed within SLA in the past 30 days and the rest still inside their deadlines.
• SLAs of 7, 15, 45, and 90 days for critical, high, medium, and low severity CVEs, respectively, with the clock starting at disclosure.
• 100% cache coverage for packages in the covered subset: every package for every supported release is in FlakeHub Cache, so a package update is always a download rather than a rebuild.

The numbers up top

At the top of the page, you’ll see five KPI-style cards, each of which links to a full list of tracked CVEs in that category:

• Fixed within SLA in the last 30 days and the last 7 days are the CVEs whose fix landed before the SLA deadline.
• Open is what’s in progress and still inside its window.
• Overdue is anything open that has passed its deadline.
• Missed SLA is anything fixed late in the last 30 days.

Those last two numbers wear red when they’re anything other than zero and green when they’re zero. As I write this, they’re both green, and the CVEs fixed on time in the past month number over 900. Every one of those is a vulnerability that our scanners detected and our team triaged, patched, rebuilt, validated, and shipped for every release we support.

Expand image

The timeline

The centerpiece is a chart of every currently tracked CVE. Each dot is one CVE, and the chart provides this information:

• Severity is the row. The lanes are critical, high, medium, and low, and each lane is labeled with its SLA: 7, 15, 45, and 90 days respectively, as in our SLA documentation.
• SLA deadline is the position along the date axis, which has a “Today” line down the middle. Anything open to the right of today still has time. Anything open to the left of today is overdue (nothing is overdue as I write this).
• Status is the color and shape:

Deadlines tend to arrive in batches, because a single CVE is filed once per release it affects and because upstream advisories tend to cluster. Rather than piling dots on top of each other, the chart stacks each day’s CVEs into a column, and a day with more than 30 wraps into columns beside it. Every dot gets drawn, so a busy week reads as a wide block instead of a smear.

Expand image

The dashed purple line in each lane marks the SLA deadline for a CVE published today. It’s the far edge of where an open dot in that lane can be, so the stack of open CVEs hugging the line in the “high” lane is exactly what you’d expect: the newest batch, with two weeks on the clock.

Dig in

Hover over a dot for the essentials, and click it to see everything the dashboard knows about that CVE: every release it’s tracked in, each with its own clock, deadline, fix date, and time to fix, plus the description and links to the same CVE in NVD and OSV.

Expand image

The chips above the chart filter by severity and status, and your selection goes into the URL, so a filtered view is a link you can share. This one, for example, shows only critical and high CVEs that are still open (not yet fixed):

To assist people with some forms of color blindness, the eye icon in the navbar switches the whole site to a color-vision-friendly palette. And of course we wouldn’t dare ship without dark mode.

Where the data comes from

The dashboard is a window onto the tracker our security team works with every day, not a separate report that we generate. Every hour, it pulls every tracked issue that’s open or was fixed in the last 30 days and redraws the interface that you see. The status of each CVE (open, overdue, fixed, or late) is computed from three timestamps (when the clock started, the deadline, and when the fix landed) using the same SLA table you’ll find in the documentation. The CVE records themselves come from NVD and OSV.

Why we built it

One of the core goals of Determinate Secure Packages is to enable you to use Nix to maximal effect without needing to run your own CVE program for Nixpkgs. Nixpkgs is enormous and upstream advisories arrive continuously, so staying on top of them for even a few hundred packages is a full-time job. Handing that job to us frees up your engineers’ time, attention, and budget for the software you’re actually building. With Determinate Secure Packages, our team does that work on the clock and ships you signed builds from SOC 2 Type II infrastructure with full coverage in FlakeHub Cache.

But it’s been hard to convey the sheer volume and relentlessness of that work. The dashboard exists to make that ongoing work visible, so that anyone evaluating Determinate Secure Packages can see what they’d be taking on without it.

Get started

Go explore the dashboard. Filter it, click around, and send someone a link.

If you’d like our team making fixes like these for you, drop us a line at sales@determinate.systems to discuss terms or schedule a demo. Once you’ve gained access, our documentation covers how the SLA works, which packages we cover, and how to switch a flake over to Determinate Secure Packages with a one-line change:

{
 inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
 inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-26.05/0";
}