Projects for other teams

Security, infrastructure and support work, done by the person who built the products. Everything on this page has run in production.

Tell us what you want See the applications

Setting up a CVE programme

From the CNA application and the scope statement to scoring, CVE record authoring and a disclosure process your own team can run afterwards.

CNA applicationScope statementCVSS scoringCVE record authoringDisclosure process

Security review

Architecture and code, written up the way an advisory is written up. Findings that come from the design of a product are kept apart from findings that come from mistakes in the implementation.

ArchitectureCodeAdvisory-style write-upDesign findingsImplementation findings

Platform and infrastructure

Vault for PKI and secrets, OIDC identity, Temporal for durable workflows and Ansible for setups that can be reproduced. Air-gapped and bare-metal installs are part of it.

Vault PKI and secretsOIDC identityTemporalAnsibleAir-gappedBare metal

Support as an engineering problem

Channel bridging, SLA clocks, inactivity handling, guarded self-service billing, and reporting that turns queue data into product signals.

Channel bridgingSLA clocksInactivity handlingSelf-service billingQueue-data reporting

Running GHub for you

We operate the GHub applications for you, in Germany. You use them and we take care of running them.

GAdvisoryGPlatform SSOGOpenCDRGeGroupsAll applications

One person does the work

You talk to the person doing it, from the first question to the last write-up.

All of it has run in production

The CVE programme, the reviews, the platform work, the support tooling and the hosted applications.

Tell us what you want

Write to us about the application, the project or the problem you have in mind.

Get in touch