What you can hire this for

Gelhaus Solutions is one person. That is the constraint worth stating first, because it decides what is worth asking for: work where judgement and depth matter more than headcount, and where the person doing it is the person who scoped it.

Everything below is something already done in production, not a capability list assembled for this page. Where the evidence is public, it is linked.

Setting up a CVE programme

Becoming a CNA is mostly paperwork and process, and the paperwork is the easy half. What takes the time is a scope statement that survives contact with a report that does not quite fit it, a scoring rubric somebody can apply consistently at two in the morning, and a disclosure timeline you can actually hold.

This covers the application, the scope statement, the rubric, record authoring against CVE JSON 5.1, and the disclosure process around it — set up so your own people run it afterwards rather than depending on me.

Postiz is a CNA with MITRE as TL-Root and GCVE Numbering Authority 125. I run that programme. The record is public and every figure on it is fetched from the registry that owns it.

Security review

Architecture and code, written up the way an advisory is written up: scope, vector with the reasoning beside it, a weakness chain rather than a single label, and a record you can hand to somebody else.

The thing worth paying for is not a list of findings. It is the part that says which findings come from the shape of the product rather than from a mistake in it, because that is the difference between closing tickets and lowering the rate at which they arrive.

Platform and infrastructure

Vault for PKI and secrets — Raft storage, a root and intermediates, ACME issuance, dynamic engines so credentials are short-lived by default. Self-hosted identity over OIDC. Temporal where work has to survive a restart. Ansible so it is reproducible rather than lovingly hand-tuned.

Also the unglamorous half: making self-hosting a real option rather than a nominal one. Air-gapped installs, bare metal ahead of containers where the choice comes up, and no dependency on a vendor continuing to exist.

Support as an engineering problem

Support volume is the most honest product feedback there is, and most teams throw it away by treating support as staffing rather than as a system.

This covers the tooling and the shape: bridging customers' own channels to real support software, SLA clocks, inactivity handling, self-service billing with guardrails, and the reporting that turns a queue into a signal about the product.

Running GHub for you

If one of the applications is what you want but running it yourself is not, GPlatform is the hosted half. Same software, same data model, a different party holding the keys — and you can move between the two without changing tools.

Where we hold your data, the data processing agreement and the annex for that service apply.

How it works

Scoping first, in writing, before anything is quoted. Then a fixed piece of work with a stated outcome, or an ongoing arrangement if that fits better.

German or English, whichever suits you. Both are worked in daily.