Critical-severity findings
A 10.0 for arbitrary code execution and token exfiltration in a CI workflow, and a 9.9 for super-admin takeover through JWT forgery. Scored and written up properly, not reported in passing.
Security
Two programmes, one standard
A CVE Numbering Authority at Postiz, and the disclosure programme for my own work at Gelhaus Solutions. Separate organisations, separate scopes, and one set of rules about how a finding gets handled.
Two programmes
Where a finding goes
Postiz
A live CVE Numbering Authority
CNA-2026-0055, a CNA with MITRE Corporation as TL-Root, and GCVE Numbering Authority 125. Postiz belongs to its maintainers rather than to me; I run the programme. 17 advisories and 15 CVEs are on the public record.
Gelhaus Solutions
Policy, scope and reporting
My own software: the GHub line and the tools published under Gelhaus Solutions. The disclosure policy, the response timelines and the list of what is covered live here. The CNA application is in progress.
How it runs
Which programme covers a finding depends on whose software it is in, and the two do not overlap. Postiz belongs to its maintainers and has its own CNA. Gelhaus Solutions is mine. A report sent to the wrong one gets forwarded rather than dropped, but sending it to the right one is faster.
The standard both run to
A finding is not reported until it has been scoped, scored against a stated rubric, mapped to a weakness chain, written into a valid record, and disclosed on a timeline both sides agreed to. A screenshot in a chat thread is not a report.
I hold my own findings to that standard too. Contribution Checker has published advisories against it under the GSSA- prefix, written up the way a third-party finding would be. Publishing against your own product is the cheap version of a promise, and it means these pages are not the only thing making claims.
What sits behind it
33 published advisories and 15 CVEs, three critical, the highest scoring 10.0. Records go out in CVE Record Format 5.1 and OSV, scored with CVSS 3.1 and 4.0, with the vector written down rather than just the number.
All of it publishes through GAdvisory, which is my own platform, running in production at gadvisory.org.
Vulnerability research
Formal over anecdotal
Scope, vector, weakness chain, written record. Every time.
Bug classes, not bug reports
Eight of the SSRF advisories trace to one property: a scheduler exists to fetch attacker-influenced URLs. A cluster that size needs a structural answer, not eight patches.
33 advisories on the public record
15 with CVEs, three critical. Every one scoped, scored with its vector written down, mapped to a weakness chain and disclosed on an agreed timeline.
Upstream ecosystem
osv-schema
Contributions to the OSV schema itself.
osv.dev onboarding
Brought the GitroomHQ/PSA namespace onto osv.dev.
Advisories against my own code
Contribution Checker's findings are published under the GSSA prefix on the same platform, in the same format as any third-party report.
Platform engineering
HashiCorp Vault in production
Raft storage, a full PKI with root and intermediate CAs, ACME issuance, dynamic secrets engines, OIDC through self-hosted Authentik.
Temporal
Workflow orchestration across every Postiz deployment.
Monitoring
Sentry for error tracking, plus custom Prometheus exporters.
Infrastructure automation
Ansible across a four-node Proxmox cluster, VLAN-segmented and firewalled.
An advisory platform in production
GAdvisory runs at gadvisory.org, publishing under two prefixes across three products. I use the thing I built.
Support & trust
Support stack migration
Evaluated the options, then moved us onto them.
Discord support bot
Written from scratch. Billing lock, refund flows, CSAT, rate limiting, canned responses.