Securityintermediate

Security Update Policy

Tracking advisories, defining patch windows by severity, and keeping an emergency path that has been rehearsed.

3 min readIntermediateUpdated 31 Jul 2026Edit this page

Database vulnerabilities are published with fixes. The gap between publication and patching is the window during which the vulnerability is both known and present in your environment.

Know what you run

You cannot patch what you have not inventoried:

Engine and exact version, per cluster.
Extensions and plugins, with their versions.
Client drivers, which have their own advisories.
Connection poolers, proxies and exporters — a vulnerability in PgBouncer or an exporter is a vulnerability in your data path.
The base image and OS packages, in containerised deployments.

SELECT version();
SELECT extname, extversion FROM pg_extension ORDER BY 1;

The engine project's security announcements list.
The distribution's security advisories, if you install from packages.
Your cloud provider's maintenance notifications for managed services.
A CVE feed filtered to the software you actually run.

Assign the subscription to a team address, not to an individual — advisories arriving in the inbox of someone who has changed roles is a common and quiet failure.

Define windows by severity

Severity	Target	Notes
Critical, remotely exploitable, no authentication	Days	Emergency change process
High, requires authentication or local access	Two weeks	Next scheduled window
Medium	Next regular minor upgrade	Batched
Low	Next major upgrade cycle	Batched

Write the targets down and measure against them. A policy nobody measures becomes a policy nobody follows.

Keep minor upgrades routine

Minor versions are where security fixes ship. Deferring them accumulates a backlog that eventually forces a large, risky jump under time pressure.

Make them boring: schedule them, apply to a replica first, use the rolling procedure, and keep the previous package available so a rollback is a reinstall.

Rehearse the emergency path

Also prepare the compensating controls you can apply immediately while the patch is being validated: restricting network access to the affected port, disabling the vulnerable feature, or revoking a privilege the exploit requires. Those buy time, and knowing them in advance is what makes the days between disclosure and patching survivable.

End of life

Track the end-of-life date for every version you run, in the same calendar as certificate expiries. An unsupported version receives no security fixes at all, and the upgrade you were deferring becomes mandatory at the least convenient moment.