About

Three things I keep coming back to

Vulnerability data, open-source governance, and stock markets. Almost everything I build traces back to one of them.

Background

The three threads

GAdvisory and the CNA work come from the first. How I think about licensing and maintainer burnout comes from the second. GBoarse comes from the third.

That's not a coincidence. You end up building tools for the problems you keep walking into.

Vulnerability data

The interesting problem was never finding bugs. It is that advisory data gets stuck where it was published: easy to read on the platform hosting it, awkward everywhere else.

Running a CNA means living inside that. Assignment, scoring, weakness chains, record formats, disclosure timelines. GAdvisory exists because the friction in those workflows is not theoretical to me, and GAnalytics exists because I wanted to measure whether the programme as a whole is getting better or worse rather than guess.

Open-source governance

Working on a project that is genuinely open source, next to a product line that is deliberately not, forces you to be precise about the difference.

GHub is open core and I say so. I do not call it open source, because it isn't. Postiz is open source and belongs to its maintainers, and my part in it is a contribution rather than a possession. Collapsing those two would misrepresent both.

Contribution Checker came out of the other half of this: popular repositories attract pull requests nobody asked for, and the expensive part of triaging them is not the code review.

Stock markets

The one thread with no professional justification, which is probably why it is the most fun.

GBoarse is a full market simulation with a real central limit order book, double-entry bigint accounting, and a deterministic replayable core. Markets are an unusually honest systems problem: the rules are written down, the failure modes are well documented, and the accounting either balances or it doesn't.

How I build

UI-first, everywhere. If the API can do it, the UI has to do it too. It costs more up front and I've never regretted it.

Self-hosting as the primary target rather than the afterthought. Bare metal ahead of containers where the choice comes up. Things that must survive a restart run on durable workflows rather than in-process timers, because a bot that restarts should not lose the auto-close it promised.

Where I work

Germany, in German and English. Advisories, release notes and support replies go out in whichever one suits the person reading them.

Personal projects and the homelab sit under Gelhaus Solutions. The work page covers what runs there and why it is built that way.

Away from the terminal

Self-hosting and network engineering, mostly. Watching where the industry is actually going rather than where the press releases say it is.

Capabilities

Tools and systems I run

Security
CVE / CNA operations CVSS 3.1 & 4.0 CWE CVE JSON 5.1 GHSA OSV / osv.dev Coordinated disclosure
Identity & secrets
HashiCorp Vault · Raft, PKI, ACME Authentik · self-hosted OIDC OpenID Connect
Platform
Proxmox · four-node cluster Ansible Docker Kubernetes Nginx Linux VLAN segmentation
Orchestration
Temporal Jenkins CI/CD pipelines BullMQ · Redis-backed queues Turborepo · pnpm workspaces GitHub Actions GitLab CI
Monitoring
Sentry Prometheus · custom exporters Grafana
Backend
Node.js NestJS TypeScript Python Bash Fastify Express gRPC · Protobuf, typed clients
Data
PostgreSQL MySQL / MariaDB Redis MongoDB InfluxDB SQLite Prisma Drizzle ORM TimescaleDB · time-series over Postgres Meilisearch MinIO / S3-compatible storage
Frontend
React Next.js JavaScript HTML & CSS Figma Tailwind CSS tRPC
Testing
Vitest Jest Playwright · deploy-gating smoke suites

Questions

Things people ask

Is GHub open source?

No. Open core. The base version of every app is free, Pro and Enterprise aren't, and all of it sits under a proprietary licence I hold every right to. It isn't AGPL.

Postiz, where I work, is open source. My own line isn't, and I try to keep that clear.

Why is everything UI-first?

Because a feature that only exists behind a CLI flag or an undocumented endpoint is a feature only maintainers really have.

It costs more up front. I've never regretted it.

How do I report a security vulnerability?

Email, coordinated disclosure. You'll get an acknowledgement, a scoped and scored assessment, and a timeline we agree on. There's a PGP key published over WKD if you need to encrypt it.

What is the fastest way to reach you?

Email if it needs a record. Discord if we are already mid-conversation. Those are the only two.

Do you work in German as well as English?

Yes, both, daily. Advisories, release notes and support replies go out in whichever one suits the reader.

What is Gelhaus Solutions?

The umbrella for my homelab and my personal and community projects. Separate from the Postiz role.

Why fork a project instead of contributing upstream?

Because some changes only make sense for how I work, and asking a maintainer to carry them is not fair on either of us.

Vulnogram is the clearest case. The attachment handling and CVSS vector pasting I added fit the way I run advisory work, and would be noise for a CNA that works differently. Forking was cheaper than arguing for every change, and more honest about who the changes are for.

Where the upstream wants something, it goes upstream. Postiz and the OSV work are contributions, not forks.

What does "closed source" mean on this site?

Not published. It does not mean undocumented.

Some of it is client work, where somebody paid for it and the code is theirs rather than mine to hand out. The rest is my own work I decided not to open.

Either way the entry describes the problem and what was built to solve it, because that part is mine to talk about.