Radiator software security and dependency compliance

Radiator scans dependencies for known vulnerabilities before release. Radiator builds also produce reports that list open source components and scan results.

Technology overview

Radiator Server is implemented in Rust and TypeScript. Rust prevents many memory corruption problems in safe Rust. These problems include buffer overflows, use-after-free errors, and data races.

The management UI is implemented in TypeScript and React. Radiator Server does not require or include Node.js at runtime.

Vulnerability scanning

Continuous integration (CI) checks application dependencies against public vulnerability databases.

Rust dependencies are scanned with cargo deny against the RustSec Advisory Database. JavaScript and TypeScript dependencies are scanned with pnpm audit. A reported vulnerability or an incomplete scan fails the build.

Build reports

Artifact and documentation builds create reports for their exact source revision:

• Open source compliance report lists third-party Rust and Management UI runtime dependencies. It includes each component's version, license expression, and source.
• Dependency vulnerability scan contains the vulnerability scan result and scanner output.

Dependency update policy

Dependencies are reviewed and updated regularly. If a Common Vulnerabilities and Exposures (CVE) entry affects Radiator, the dependency is updated and a fix is released. Advisories that do not affect Radiator's use are tracked until an upstream fix is available.

Build and release integrity

Dependency versions are pinned. Updates require a reviewed source change. Release artifacts are traceable to a source revision. CI applies code review, automated tests, lint checks, and vulnerability scans before release.

Maintenance scope

Standard service covers fixes in actively maintained release lines. Backporting fixes to older or end-of-life versions is available as a separate support engagement.