“We handle the maintenance” is easy to say, but it is hard to see what that actually involves. This article opens up exactly what we do during our monthly security operations.
Why monthly
Vulnerabilities are disclosed on no fixed schedule. The urgent ones we address immediately, but for everything else we set a recurring monthly window to apply updates together. That makes it far easier to keep a record of when each change landed, and far easier to roll back if something goes wrong.
The actual workflow
Every month we run the following steps in a consistent order.
- Inventory the dependencies — review which packages can be updated and what changed
- Apply the updates — pull them in, starting with the lowest-impact ones
- Build and diff — build in a staging environment and confirm nothing rendered incorrectly
- Promote to production — once it is clean, deploy to production and log the work
Always record the change
What we value most is keeping a record of every change. If you cannot trace when, what, and why something was updated, you cannot isolate the cause when an incident hits.
Because the Git commit history doubles as the work log, anyone reviewing it later can follow the full chain of events.
Visible to the business
Even as a technical-delegation service, we believe this work must never become a black box. We report each month’s work in a concise form so the business always knows what is being protected. That, to us, is the kind of operation that earns trust.