GAdvisory
A security advisory platform that isn't tied to one ecosystem's database.
A security advisory platform for publishing, tracking and consuming vulnerability data without being tied to one ecosystem's database. The closest thing I have to a product version of the day job.
The other half
Hosted by us as GPlatform Advisory: the same software, with additional modules available only there. It is one product, so these terms, this privacy notice and this processing annex cover both ways of having it.
Why it exists
GHSA is good infrastructure. It's also one ecosystem's advisory database, with that ecosystem's assumptions baked into it.
Advisory data has a habit of getting stuck where it was published. Easy to read on the platform hosting it, awkward everywhere else.
GAdvisory is the alternative.
Where it came from
This is the product closest to my day job. Running the CNA at Postiz means living inside advisory workflows: assignment, CVSS scoring, CWE chains, JSON records, disclosure through GHSA. The friction in those workflows isn't theoretical to me.
How the data is organised
Advisories sit in a three-level hierarchy: group, then organisation, then project. Each level can set its own advisory ID prefix, and the most specific one wins.
That is not a detail. It is how one instance publishes PSA- records for one product and GSSA- records for another without either borrowing the other's numbering, and without running two installs to get it.
Getting reports in
Four intake routes, because reporters do not agree on one: a web form, the REST API, GitHub and GitLab webhooks, and IMAP polling.
Anonymous submission is opt-in per scope. The right answer differs between an internal tracker and a public product, so it is a setting rather than a policy.
Getting records out
Every advisory carries a visibility. Public, unlisted behind a capability URL, or private. Coordinated disclosure runs on cross-scope embargo participants, so the people who need to read a draft can, and nobody else can.
There are first-class adapters for the MITRE CVE Services API and the GitHub CNA, with a configurable delay before auto-publish. Requesting an identifier and publishing the record are one workflow here, which is what they already are in practice. Keeping them in two systems and reconciling by hand is the part that goes wrong.
Records serialise to CVE Record Format 5.x and to OSV. It reads EPSS, CWE and CVSS v3.1 and v4.0. Public advisory pages carry JSON-LD.
Who can do what
Fixed roles cover the shape most instances need: owner, admin, maintainer, triager, reporter, viewer. Custom roles sit on top of that, CASL-backed, for the cases the fixed set does not fit.
SSO is deliberately broad. GitHub, Google, GitLab.com, self-hosted GitLab, generic OIDC and generic SAML 2.0, with just-in-time provisioning and identity linking. An advisory platform nobody can log into is an advisory platform nobody reads.
How it's built
UI-first, like the rest of the line. That matters more here than usual. The people who most need to read a security advisory are often the least comfortable at a command line.
TypeScript throughout. NestJS and Prisma over PostgreSQL 16, Redis, Meilisearch for search, and S3-compatible object storage with MinIO bundled. Next.js on the front, Socket.IO with a Redis adapter for realtime. BullMQ workers run as their own process by default and collapse into the API for small installs. Envelope encryption through libsodium, data-encryption keys under a key-encryption key.
Bare metal with systemd units is the primary deployment target and docker-compose is the secondary, which is the reverse of the usual order and deliberate. It runs air-gapped.
English and German from launch, for the same reason the advisories go out in both.
Status
Shipped and running. The production instance publishes at gadvisory.org and currently carries 33 advisories across Postiz App, Contribution Checker and GAdvisory itself.
Legal: Terms · Privacy notice · Processing agreement