GHub is a line of applications built for your own infrastructure. GPlatform is the hosted half, for the people who would rather not run them. Same software either way.
Gelhaus Solutions is the applicant behind the CNA that covers this work. The policy says what we commit to, the scope says what is covered, and the record shows what has actually been published.
Disclosure policy
/security/policy
How to report a vulnerability in anything Gelhaus Solutions publishes or runs, what is covered, and what happens after you send it.
CNA scope
/security/scope
The scope as submitted, what it covers for each product, and what has been asked for but not yet granted. The reporting process is on the policy page.
The record
/security/record
Advisory counts, CVE assignments, commits and ranks, each fetched from the system that owns it and stamped with the time it was read.
Every application, what it does, and where it actually stands. Grouped the way the work is grouped, not the way a catalogue would be.
Five things, all of them already done in production rather than assembled for this page. One person, so depth over headcount.
What shipped, what changed, and the reasoning behind it.
Release notes and writing, grouped by what they are about.
The same channels as everything else here, and a form further down for anyone who would rather use one. Email still reaches the same inbox one step sooner.
Information required under section 5 DDG.
What this site processes, and what it does not.
The terms on which this site, the GHub applications and the GPlatform services are made available.
The Art. 28 GDPR terms for every hosted service. What a particular service processes is named in its own annex.
If you are a consumer, you may withdraw from a contract with us within fourteen days without giving a reason. This page is the instruction, the form, and the one thing that can cost you the right.
Report content
/report-content
How to tell us that something we host is illegal, what we do with a report, and how to challenge a decision. This is the Art. 16 DSA channel, and it is not the security disclosure policy.