CNA scope statement

Asked of MITRE as part of the CNA application, in the same request as the gadvisory.org clause. Awaiting a decision.

The coordination already happens here. The reproduction, the contact with the vendor, the severity call and the disclosure date sit with whoever did the work, and today the identifier has to be requested from a CNA that has none of those things in front of it. The clause would put the number with the party doing the coordinating. It asks for nothing else over anyone else's product.

The finding is handled either way, and the route is the same one it has always been. Gelhaus Solutions contacts the vendor, writes the advisory and publishes it on gadvisory.org under a Gelhaus Solutions advisory identifier. That part needs nobody's permission. The CVE is requested from the product's own CNA where it has one, and from the CNA of Last Resort where it has none, with Gelhaus Solutions named on the record as the reporter rather than the assigner. If you have found something in software that is not mine and want help getting it to the people who can fix it, that offer stands today and does not depend on this.

It is a clause about who assigns an identifier, and nothing more. The fix, the timeline and the decision to publish stay with the vendor whose software it is. The response times on the disclosure policy are commitments about products in the scope above, not about somebody else's code. And a product whose vendor runs its own CNA stays with that CNA no matter who found the bug.

Asked of MITRE as part of the CNA application. Awaiting a decision.

GAdvisory already holds the whole record for these projects: the maintainers onboarded them, and the advisory is drafted, reviewed and published there. The identifier is the single part that has to come from somewhere else, which splits one advisory between two parties and leaves the maintainer chasing the half that is not here. The clause would close that gap, and only for maintainers who ask it to.

Until there is an answer this is not in scope and is deliberately absent from the statement above. A third-party project onboarded to gadvisory.org can have its advisory hosted and published there today (that part needs nobody's permission), but the identifier still has to come from the project's own CNA, or from the CNA of last resort where it has none.

Onboarding a project would not put it in scope by itself: the maintainers have to ask, per project, and they can stop asking. Hosting an advisory on gadvisory.org transfers nothing and implies nothing: a project whose vendor runs its own CNA keeps it, and GPlatform Advisory customers are covered by this clause on exactly the same terms as anyone self-hosting, which is to say not yet.