Spotify’s Vulnerability Management Platform

This post details the journey of building Spotify's Vulnerability Management Platform (VMP), Kitsune. It describes the transition from a basic automation pattern using Comet to a more robust system with defined vulnerability lifecycle states, a Backstage UI plugin for visualization and prioritization, and a relational data structure for analysis. The architecture includes a 'mediator' concept to decouple RCs and handle RC-specific logic, enabling integration with multiple vulnerability sources like HackerOne and manual CSV uploads. The platform also provides metrics and insights for security teams and management.