Shipped GHub Creator and maintainer Open core 2026 - present

GAdvisory

A security advisory platform that isn't tied to one ecosystem's database.

A security advisory platform for publishing, tracking and consuming vulnerability data without being tied to one ecosystem's database. The closest thing I have to a product version of the day job.

The other half

Hosted by us as GPlatform Advisory: the same software, with additional modules available only there. It is one product, so these terms, this privacy notice and this processing annex cover both ways of having it.

Why it exists

GHSA is good infrastructure. It's also one ecosystem's advisory database, with that ecosystem's assumptions baked into it.

Advisory data has a habit of getting stuck where it was published. Easy to read on the platform hosting it, awkward everywhere else.

GAdvisory is the alternative.

Where it came from

This is the product closest to my day job. Running the CNA at Postiz means living inside advisory workflows: assignment, CVSS scoring, CWE chains, JSON records, disclosure through GHSA. The friction in those workflows isn't theoretical to me.

How the data is organised

Advisories sit in a three-level hierarchy: group, then organisation, then project. Each level can set its own advisory ID prefix, and the most specific one wins.

That is not a detail. It is how one instance publishes PSA- records for one product and GSSA- records for another without either borrowing the other's numbering, and without running two installs to get it.

Getting reports in

Four intake routes, because reporters do not agree on one: a web form, the REST API, GitHub and GitLab webhooks, and IMAP polling.

Anonymous submission is opt-in per scope. The right answer differs between an internal tracker and a public product, so it is a setting rather than a policy.

Getting records out

Every advisory carries a visibility. Public, unlisted behind a capability URL, or private. Coordinated disclosure runs on cross-scope embargo participants, so the people who need to read a draft can, and nobody else can.

There are first-class adapters for the MITRE CVE Services API and the GitHub CNA, with a configurable delay before auto-publish. Requesting an identifier and publishing the record are one workflow here, which is what they already are in practice. Keeping them in two systems and reconciling by hand is the part that goes wrong.

Records serialise to CVE Record Format 5.x and to OSV. It reads EPSS, CWE and CVSS v3.1 and v4.0. Public advisory pages carry JSON-LD.

Who can do what

Fixed roles cover the shape most instances need: owner, admin, maintainer, triager, reporter, viewer. Custom roles sit on top of that, CASL-backed, for the cases the fixed set does not fit.

SSO is deliberately broad. GitHub, Google, GitLab.com, self-hosted GitLab, generic OIDC and generic SAML 2.0, with just-in-time provisioning and identity linking. An advisory platform nobody can log into is an advisory platform nobody reads.

How it's built

UI-first, like the rest of the line. That matters more here than usual. The people who most need to read a security advisory are often the least comfortable at a command line.

TypeScript throughout. NestJS and Prisma over PostgreSQL 16, Redis, Meilisearch for search, and S3-compatible object storage with MinIO bundled. Next.js on the front, Socket.IO with a Redis adapter for realtime. BullMQ workers run as their own process by default and collapse into the API for small installs. Envelope encryption through libsodium, data-encryption keys under a key-encryption key.

Bare metal with systemd units is the primary deployment target and docker-compose is the secondary, which is the reverse of the usual order and deliberate. It runs air-gapped.

English and German from launch, for the same reason the advisories go out in both.

Status

Shipped and running. The production instance publishes at gadvisory.org and currently carries 33 advisories across Postiz App, Contribution Checker and GAdvisory itself.