Two programmes, one standard

A CVE Numbering Authority at Postiz, and the disclosure programme for my own work at Gelhaus Solutions. Separate organisations, separate scopes, and one set of rules about how a finding gets handled.

Two programmes

Where a finding goes

Postiz

A live CVE Numbering Authority

CNA-2026-0055, a CNA with MITRE Corporation as TL-Root, and GCVE Numbering Authority 125. Postiz belongs to its maintainers rather than to me; I run the programme. 22 advisories and 20 CVEs are on the public record.

The Postiz programme

Gelhaus Solutions

Policy, scope and reporting

My own software: the GHub line and the tools published under Gelhaus Solutions. The disclosure policy, the response timelines and the list of what is covered live here. The CNA application is in progress.

Security policy

Every figure on these pages is read from the system that owns it, checked 15 minutes ago. The record, with its sources

How it runs

Which programme covers a finding depends on whose software it is in, and the two do not overlap. Postiz belongs to its maintainers and has its own CNA. Gelhaus Solutions is mine. A report sent to the wrong one gets forwarded rather than dropped, but sending it to the right one is faster.

The standard both run to

A finding is not reported until it has been scoped, scored against a stated rubric, mapped to a weakness chain, written into a valid record, and disclosed on a timeline both sides agreed to. A screenshot in a chat thread is not a report.

I hold my own findings to that standard too. Contribution Checker has published advisories against it under the GSSA- prefix, written up the way a third-party finding would be. Publishing against your own product is the cheap version of a promise, and it means these pages are not the only thing making claims.

What sits behind it

42 published advisories and 20 CVEs, seven critical, the highest scoring 10.0. Records go out in CVE Record Format 5.1 and OSV, scored with CVSS 3.1 and 4.0, with the vector written down rather than just the number.

All of it publishes through GAdvisory, which is my own platform, running in production at gadvisory.org.

Vulnerability research

Critical-severity findings

A 10.0 for arbitrary code execution and token exfiltration in a CI workflow, and a 9.9 for super-admin takeover through JWT forgery. Scored and written up properly, not reported in passing.

Formal over anecdotal

Scope, vector, weakness chain, written record. Every time.

Bug classes, not bug reports

Eight of the SSRF advisories trace to one property: a scheduler exists to fetch attacker-influenced URLs. A cluster that size needs a structural answer, not eight patches.

42 advisories on the public record

20 with CVEs, seven critical. Every one scoped, scored with its vector written down, mapped to a weakness chain and disclosed on an agreed timeline.

Upstream ecosystem

osv-schema

Contributions to the OSV schema itself.

osv.dev onboarding

Brought the GitroomHQ/PSA namespace onto osv.dev.

Advisories against my own code

Contribution Checker's findings are published under the GSSA prefix on the same platform, in the same format as any third-party report.

Platform engineering

HashiCorp Vault in production

Raft storage, a full PKI with root and intermediate CAs, ACME issuance, dynamic secrets engines, OIDC through self-hosted Authentik.

Temporal

Workflow orchestration across every Postiz deployment.

Monitoring

Sentry for error tracking, plus custom Prometheus exporters.

Infrastructure automation

Ansible across a four-node Proxmox cluster, VLAN-segmented and firewalled.

An advisory platform in production

GAdvisory runs at gadvisory.org, publishing under two prefixes across three products. I use the thing I built.

Support & trust

Support stack migration

Evaluated the options, then moved us onto them.

Discord support bot

Written from scratch. Billing lock, refund flows, CSAT, rate limiting, canned responses.