GAdvisory terms

What this covers

GAdvisory is a platform for coordinated vulnerability disclosure: receiving reports, coordinating with the people who can fix a problem, reserving and publishing identifiers, and publishing advisories. It can be operated as a CNA's working system and as a registry of records.

These terms cover using it. They sit alongside the general terms of service, which carry liability, governing law and everything else not specific to this product.

The two ways to have it

You run it. GAdvisory is licensed under the Elastic License 2.0, plus one additional restriction from us: commercial use requires a business licence.

That addition is stated separately because ELv2 does not contain it. ELv2's own limitations are three (you may not provide the software to others as a hosted or managed service, may not circumvent the licence-key functionality, and may not remove or alter the licensing, copyright or other notices), and it otherwise permits a company to run the software commercially for its own internal purposes. Our additional term removes that permission.

Non-commercial use on your own infrastructure is free of charge. Commercial use of any kind, including internal use inside a business, needs a business licence from us.

Some features are gated behind a licence. That is a deliberate part of the design rather than an accident of packaging, and the gating is enforced by the software.

Where you run it yourself, you operate the service. We have no access to your instance, no visibility into it, and no part in what you do with it.

Your own instance is governed by its licence. The licence to use the hosted services in the general terms does not replace it, and nothing in these terms or the general terms restricts that licence or your rights under Sections 69d and 69e UrhG.

We run it. Where you use a hosted instance, we operate it and the data processing agreement applies together with the GAdvisory annex to it.

gadvisory.org is open to public registration. Hosted GAdvisory moves from there to advisory.gplatform.org, where registration is by invitation. Accounts at either address are provided without a service level.

How that move is made. It is a move of your account under the general terms. We email you at least 30 days before registration closes and at least 30 days before any migration that affects your data, at the address on your account, and say what moves. Existing accounts and the advisories, reports and identifiers in them carry over; the move is a change of address and of who may register, not a reset. Where an account cannot be carried over we tell you why, with time to export first, and export stays available throughout. If the move makes your access materially harder, you may end the contract free of charge within 30 days.

Entitlements move when the plan moves

Features are granted to a scope (an organisation, a project) by assigning it a plan, or by granting a feature directly. A plan is referenced live, not copied at the moment of assignment.

That means editing a plan changes every scope assigned to it, immediately. It is how a tier can be adjusted without a morning of clicking, and it is the whole cost of that: there is no per-scope snapshot to fall back on. Every such edit is recorded in the audit log.

Retiring a plan does not withdraw it from anyone. An archived plan refuses new assignments and keeps serving the scopes already on it.

A plan assignment cascades to the scopes beneath it. A descendant carrying its own plan or its own grant overrides what it inherits.

On the GAdvisory we host, we are the ones who edit plans. We reduce what a plan gives you only as the general terms allow a service to be changed: for a stated reason, at no extra cost and with notice in advance; where your use is materially impaired, you may end the contract free of charge. A lower cap never removes what exists; it refuses the next one.

Reporting a vulnerability

If you send a report through GAdvisory, to us or to anyone else running it:

Send what is needed to understand and reproduce the problem. Proof-of-concept code is part of a serious report and is expected; using a disclosure channel to distribute malware, or to attack the recipient, is not.

Your report is kept as it was sent. The raw inbound message is retained beside the parsed version, because a report parsed wrongly has to be readable as it was written. Where it arrives by email, the headers are kept with it.

An embargo is something you accept, not something implied. Where an advisory is under embargo, participants are named and each records their acceptance. If you are added to one, what you agreed to is not to disclose before the date.

Not accepting an embargo is not permission to publish. It means the embargo's own terms do not bind you; it does not release you from anything else. Confidentiality you already owe, a duty arising from how the material reached you, and the protection of trade secrets under the GeschGehG all continue to apply on their own terms, and a platform cannot and does not waive them for you. If you receive embargoed material you have not accepted an embargo over and do not wish to be bound, the thing to do is tell the coordinator and stop reading it.

Credit is optional and it is consent. If you ask to be credited, we publish the name and contact you asked for. You may withdraw that consent and we will remove the credit from our copy.

Publication is permanent. A published advisory is mirrored, indexed and aggregated into vulnerability databases with which we have no relationship. We can change our copy. We cannot change theirs. This is stated at length in the privacy notice and it is the single thing worth understanding before asking to be named.

Running a disclosure programme

If you use GAdvisory to receive reports:

The reports are yours to handle. You decide what to act on, what to publish, whom to credit and when. We do not triage on your behalf, do not validate what you receive, and do not contact reporters for you.

You are responsible for what you publish, including for advisories naming products that are not yours. Where a record makes a claim inside a container belonging to somebody else, that party can contest it. GAdvisory records the contest and renders it as an unresolved reference rather than discarding it; it does not decide who is right. That is between you and them, and neither the software nor we adjudicate it.

Where you operate as a CNA through GAdvisory, the rules of the CVE Program apply to you in addition to these terms, and they come from the CVE Program rather than from us. Nothing here grants CNA authority, a CNA scope, or the right to assign an identifier.

Artificial intelligence

The AI features are off unless somebody turns them on, are configured per scope, and run on an API key you supply. GAdvisory ships no model provider. If you enable them, the content of a disclosure report can be sent to whichever provider that key belongs to, on that provider's terms, and each stored credential records whether that provider trains on what it is sent.

On gadvisory.org and the hosted service they are enabled for the scopes Gelhaus Solutions and Postiz own, restricted to the Gelhaus Solutions team as the people who may run them rather than restricted in what they may read. Within those scopes that reaches disclosure reports, queues and disputes. The provider is OpenRouter, routing to Google Gemini.

This does not extend to your scope. We do not run AI tasks over a customer's scope. The AI configuration for your scope is yours, the key is yours, and the provider is whichever your key belongs to. See the privacy notice and the processing annex, which say the same thing in more detail.

Acceptable use

Beyond the general terms: do not use a disclosure platform to coordinate an attack, to threaten anybody, or to extort. Do not submit reports you have no good-faith belief in to occupy somebody's queue. Do not use an embargo you have been admitted to as a source of trading advantage.

We may restrict or suspend an account that does any of these. We say why no later than when it takes effect, and before suspending or ending an account we hear you first, except in the urgent cases the general terms list, such as an attack on others.

Availability

No service level is promised for hosted GAdvisory unless a separate signed agreement states one. See the general terms.

If it ends

If hosted GAdvisory is discontinued, or your contract for it ends, the notice periods are those in the general terms, and you can export your data for 30 days after the end. Then it is deleted, except what the law requires us to keep and the permanent records below; for personal data we process on your behalf, the deletion terms in the data processing agreement apply.

Advisories already published stay published. That is what publishing them meant.

What you can take with you

When you switch to another provider under the general terms, or at any time before, you can take the following with you. The list is exhaustive; our switching page describes the formats and every limit we know of.

• your account: profile, memberships and roles, sessions, notification settings, channels and digest subscriptions, saved views and watches, and the terms and publishing consents you gave;
• your organisations, groups and projects, with their settings: CNA and GCVE configuration, request forms, repository links, Git sync and webhooks;
• advisories, with their affected products and version ranges, references, impact, revisions, timeline, credits, collaborators, comments and attachments;
• reports and requests, with their messages, drafts and proposals, and the share links you created;
• AI runs and the proposals they produced;
• the audit log;
• the names, scopes and dates of your API tokens and OAuth authorisations;
• anything else you or your users put into hosted GAdvisory or generated by using it, with its metadata.

How. Each person downloads their own data under Settings › Account › Data export. Each advisory downloads as a CVE record and as a GCVE record from the advisory itself, and Git sync keeps advisories, submissions, comments and audit entries in a repository of your own. Everything else, and everything at once for an organisation, we hand over as JSON when you ask.

Formats. JSON and NDJSON; CVE JSON 5 (the CVE Record Format); GCVE JSON (BCP-05); attachments in the format they were uploaded in.

What stays behind. Only password and token hashes, the keys and targets of AI credentials and notification channels (a channel's target, such as a webhook address, carries its secret) and where they are stored, the keys of push subscriptions, webhook signing secrets, one-time confirmation, unsubscribe, reply and verification tokens, and our internal database identifiers. Leaving these behind never delays or prevents a switch.

Published advisories and the CVE records published from them stay published; a switch does not withdraw them.

Your content, your account and these clauses

The general terms carry these clauses in full: the licence to your content, permanent records, moving accounts, new terms, restrictions and suspension, and ending a service. This section says only what is specific to hosted GAdvisory. None of it applies to an instance you run yourself.

The licence covers what you submit. The reports, advisories, comments and attachments you submit to GAdvisory as we host it. You keep all rights in them, and we use them only to operate and provide hosted GAdvisory as these terms describe. You also allow us to edit, summarise and translate a report to publish an advisory from it, crediting you as you choose, and the affected vendor or maintainer whose programme you report to may do the same.

Who receives it. Only these, and only for that purpose:

• the providers who run hosted GAdvisory for us, including, for the scopes named under Artificial intelligence, the AI providers named there, which receive content only to answer the request, and our other products where your content is shown or used for the same purpose;
• the recipients of an advisory: the CVE Program, GCVE (gcve.eu), GitHub Security Advisories, GitLab (through GAdvisory's GitLab adapter), OSV, and the affected vendors and maintainers;
• a successor taking over the service under the transfer clause, and companies affiliated with Gelhaus Solutions, only to operate and provide the service.

Nobody receives a licence to your content for their own purposes.

Permanent records. Published advisories and the CVE records published from them. A published advisory can be withdrawn and a CVE record can be rejected, but neither can be deleted, and its identifier is never given to anything else. For these records you grant us, and anyone mirroring or verifying them, a licence without time limit to copy and publish them as part of that record. That is what "Publication is permanent" above means, and you are told it here before you submit.

Your account. Two moves apply to hosted GAdvisory, both made under the rules for moving accounts in the general terms: the move from gadvisory.org to advisory.gplatform.org described above, and the move of sign-in to GPlatform SSO, the sign-in service we run for our products. For each, we email you at least 30 days in advance and say what moves, and we move only the data needed to sign you in and keep what you hold. If a move makes your access materially harder, you may end the contract free of charge within 30 days. Both services are run by Gelhaus Solutions, so your account stays with us.

Free or paid. Hosted GAdvisory is free unless you pay for a plan on it. On a free account, if you have not accepted new terms when the six weeks the general terms give are over, the account is restricted until you accept: you can still sign in, read, export your data, exercise your data-protection rights, close the account and accept, and nothing else. A paid plan is never restricted: you keep it on the old terms until we end the contract at its next ordinary end date.

Restrictions. What we act on is under Acceptable use above; how we act (with reasons, and after hearing you before an account is suspended or ended, except in the urgent cases listed there) is in the general terms. To challenge a decision, reply to the statement of reasons or write to the address in the legal notice; a person looks at it again and answers with reasons.

No warranty, no service level, and limited liability

This product is provided as it is and as it happens to be available, without warranty of any kind, and is used at your own risk. No uptime, response time or restoration time is owed unless a separate signed agreement states one. Where it is provided free of charge, liability is limited to intent and gross negligence (Section 521 BGB).

To the fullest extent the law permits, we are not liable for damage arising from its use, its unavailability, or any loss of data, and keeping your own backups is your responsibility. The limits that mandatory law requires, the exclusions that apply within them, and the additional cap that applies to business customers are set out in full in the general terms of service, which govern this product and are not restated here.