Radiator software security and dependency compliance
Radiator scans dependencies for known vulnerabilities before release. Radiator builds also produce reports that list open source components and scan results.
Technology overview
Radiator Server is implemented in Rust and TypeScript. Rust prevents many memory corruption problems in safe Rust. These problems include buffer overflows, use-after-free errors, and data races.
Radiator UI is implemented in TypeScript and React. Radiator Server does not require or include Node.js at runtime.
Vulnerability scanning
Continuous integration (CI) checks application dependencies against public vulnerability databases.
Rust dependencies are scanned with cargo deny against the RustSec Advisory
Database. JavaScript and TypeScript dependencies are scanned with pnpm audit.
A reported vulnerability or an incomplete scan fails the build.
Build reports
Artifact and documentation builds create reports for their exact source revision:
- Open source compliance report lists third-party Rust and Radiator UI runtime dependencies. It includes each component's version, license expression, and source.
- Dependency vulnerability scan contains the vulnerability scan result and scanner output.
Dependency update policy
Dependencies are reviewed and updated regularly. If a Common Vulnerabilities and Exposures (CVE) entry affects Radiator, the dependency is updated and a fix is released. Advisories that do not affect Radiator's use are tracked until an upstream fix is available.
Build and release integrity
Dependency versions are pinned. Updates require a reviewed source change. Release artifacts are traceable to a source revision. CI applies code review, automated tests, lint checks, and vulnerability scans before release.
Maintenance scope
Standard service covers fixes in actively maintained release lines. Backporting fixes to older or end-of-life versions is available as a separate support engagement.