3working days
To acknowledge a report. A reporter waiting in silence cannot tell being triaged apart from being ignored, so this comes first and comes fast.
Security
How Gelhaus Solutions handles vulnerabilities, published in full: what we commit to, what is covered, and what has actually been published.
What we commit to
Every row is a commitment, not an aspiration. They apply to anything in scope, in either language, whether or not you are a customer.
10working days
To assess it: whether it is accepted, the severity, the CVSS vector with its reasoning, and the CWE chain.
90days
To disclosure, from the report or when a fix ships, whichever comes first. Extensions are by agreement and stated publicly on the record.
Three documents
What we commit to, what is covered by it, and what has actually been published.
Disclosure policy
How to report something, what happens next, and the timelines Gelhaus Solutions commits to.
Read it →CNA scope
Which software is covered by the CVE Numbering Authority, and which is deliberately excluded.
Read it →The record
Every figure this organisation states about its own advisory work, with the source and the time it was last checked.
Read it →Found something?
The channels are on the contact page, and the machine-readable version is at /.well-known/security.txt.
The person behind Gelhaus Solutions also holds a CNA role at Postiz, which is a different organisation and a different programme. That work is described on his own site.
Advisories are published on GAdvisory, and identifiers that say who assigned them are on GAVR.