---
owner_slack: "#govuk-2ndline"
title: Deploy fixes for a security vulnerability
section: Deployment
layout: manual_layout
parent: "/manual.html"
last_reviewed_on: 2018-05-31
review_in: 3 months
---

When responding to a security incident, we should review the changes in private
before deploying them, so that we don't accidentally disclose the vulnerability.

To do this, push branches to the [GitLab backup](github-unavailable.html)
of the repository, rather than the normal repository on github.com.

This repository should be up to date as of the previous release, but will be
missing any unreleased commits that are on github.com master.
This is fine as you don't want to deploy these.

## Deploy process

1. Ensure nobody else deploys the app until you've confirmed the vulnerability
   is fixed.

1. Review the pull request on GitLab

1. Create a release tag manually in git. This should follow the standard format
   `release_X`. Tag the branch directly instead of merging it.

1. Don't use the release app. Go directly to the `deploy_app` Jenkins job, and
   check "DEPLOY_FROM_GITLAB".

## After deploying

1. Ensure the vulnerability is fixed.

1. Push the branch and tag to github.com.

1. Merge the branch into master.

1. Record the missing deployment in the release app.

---
owner_slack: "#govuk-2ndline"
title: Deploy fixes for a security vulnerability
section: Deployment
layout: manual_layout
parent: "/manual.html"
last_reviewed_on: 2018-05-31
review_in: 3 months
---

When responding to a security incident, we should review the changes in private
before deploying them, so that we don't accidentally disclose the vulnerability.

To do this, push branches to the [AWS CodeCommit backup](github-unavailable.html)
of the repository, rather than the normal repository on github.com.

This repository should be up to date as of the previous release, but will be
missing any unreleased commits that are on github.com master.
This is fine as you don't want to deploy these.

## Deploy process

1. Ensure nobody else deploys the app until you've confirmed the vulnerability
   is fixed.

1. Review the pull request on AWS CodeCommit

1. Create a release tag manually in git. This should follow the standard format
   `release_X`. Tag the branch directly instead of merging it.

1. Don't use the release app. Go directly to the `deploy_app` Jenkins job, and
   check "DEPLOY_FROM_AWS_CODECOMMIT".

## After deploying

1. Ensure the vulnerability is fixed.

1. Push the branch and tag to github.com.

1. Merge the branch into master.

1. Record the missing deployment in the release app.

Update information on deploying security vulnerability fixes.
Update information on deploying security vulnerability fixes.
