Let a security fix through a freeze when the vulnerability is exploitable in your product, the change is small and tested, rollback is ready, and a named approver signs it off. Everything else waits. Write those criteria down before the freeze starts, not during it.
What a freeze is for
A release freeze reduces risk by reducing change. It exists because fewer changes mean fewer surprises during a peak period. A security fix is a change too, so an exception has to earn its place. But a blanket ban on security changes trades a known exposure for an imagined stability gain.
Criteria for an exception
| Question | Pass | Fail |
|---|---|---|
| Is the vulnerable code reachable in our product? | Yes, or cannot rule it out | Clearly unused path |
| Is there exploitation or a public exploit? | Reported or credible | None known and low severity |
| Is the change small and isolated? | A version bump or a narrow patch | Wide refactor or major upgrade |
| Is the fix tested? | Regression test and suite pass | Untested |
| Can we roll back fast? | Yes, rehearsed | No plan |
| Is an approver named? | Yes | Nobody accountable |
If most rows pass, ship. If the change is large, consider a mitigation during the freeze, such as a gateway rule or a configuration switch, and schedule the real fix for after.
Steps
- Add an exception path to the freeze policy before the freeze begins.
- Name the approvers, for example a security lead plus an engineering lead, and the backup if one is away.
- Require a short request: what is the issue, why now, what changes, how to roll back.
- Run the full pipeline. A freeze exception is not an exemption from the scan or the review.
- Deploy to a small slice first if your infrastructure allows it.
- Record every exception with the outcome. Review them after the freeze to tune the policy.
What does not qualify
- A routine update that happens to include a security note.
- A low severity issue with no path to exploitation in your code.
- A big upgrade that carries many unrelated changes.
- A fix with no test, offered on the argument that it is obviously right.
Reduce the pressure beforehand
Many freeze exceptions come from a backlog of old updates. If dependencies are kept current in small steps in the weeks before the freeze, there is little left that needs an exception. Pause automated updates deliberately at the start, and plan a catch up after.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how many findings drop out when only reachable ones count, which is the first row of the criteria table.
Safeguard's reachability analysis helps separate vulnerable components your code actually calls from those it does not, so a freeze exception can be justified with evidence. Try a free scan at gold.safeguard.sh/scan.
Quick check
Does a freeze exception skip testing?
No. The exception allows the change to ship, not to skip scans, review or tests.
Who should approve an exception?
At least two named people with different roles, such as security and engineering, plus a backup for each.
Last reviewed: 19 October 2026.
