Patch Creation SLA
For every new CVE that is detected in an existing Aikido Image, or in an Aikido Library, the following SLA apply:
| Severity | SLA |
|---|---|
| CISA KEV | 48 hours |
| Critical / High | 7 days |
| Medium / Low | Commercially reasonable |
SLA timelines start once a CVE is published and a valid fix candidate is available in the upstream ecosystem.
Scope: Bulk Rollout vs. one-off fixes
This SLA applies to Aikido Libraries enrolled via Bulk Rollout (AutoFix > Aikido Libraries > Bulk Rollout). One-off Aikido Libraries fixes taken from the Feed or from AutoFix > Dependencies, without enrolling the repository through Bulk Rollout, are not covered by this SLA.
A note on pre-existing CVEs
Aikido Libraries - the SLA covers new CVEs that arise after you enroll your repository. Pre-existing CVEs will still be fixed, but they are not covered under the SLA commitment. This is because repositories can carry a large backlog of open CVEs at the time of enrollment, and working through that debt is handled separately.