Self-hosted advisory database and CNA workflow
Security advisories you own.
GAdvisory is a self-hosted alternative to GitHub Security Advisories. Your advisories live in your database, on your hostname, with no coupling to any repository, and the whole thing runs with no network at all.
GADV-2026-8NJ00C
Authentication bypass in the session guard
Published to
- CVE-2026-1234cve.org
- GCVE-42-2026-0007gcve.eu
- GAVR-A7K2QXR8gavr.gadvisory.org
Somebody else's database is a decision, not a default.
GitHub Security Advisories are tied to a repository, served from infrastructure you do not control, and unreachable the moment you are off the network. For most open-source projects that is a perfectly good trade.
It stops being a trade when you ship to an air-gapped customer, when you hold your own remit as a numbering authority, or when your disclosure process has to answer to an auditor. GAdvisory is the same workflow with the hosting decision reversed.
Author, review, embargo, publish
Drafts belong to a project, not a repository. Advisories carry their own identifier scheme per scope, move through review, and can sit under a coordinated-disclosure embargo that lifts on a schedule.
Assign real identifiers
Reserve and publish CVEs through MITRE, the CVE Services API or GitHub as a CNA. Allocate GCVE identifiers as a numbering authority. Mint GAVR records in the federation.
Serve them where people look
Public advisory pages, a branded portal on your own verified domain, an Atom feed, a GCVE publication feed, and a full mirror into a git repository you control.
Run it on your own terms
Postgres, Redis and an object store. Secrets under your own KEK or HashiCorp Vault. Every advisory mirrored to git as canonical JSON, so the record outlives the instance.
Against GitHub Security Advisories
Where the two differ. Both do drafts, CVSS, affected version ranges and coordinated disclosure.
| Capability | GAdvisory | GitHub Security Advisories |
|---|---|---|
| Hosting | Your infrastructure | GitHub |
| Repository coupling | None: a project hierarchy | One advisory per repository |
| Works with no network | Yes | No |
| CVE assignment | MITRE, CVE Services, GitHub | GitHub as CNA |
| GCVE identifiers | Yes, as a numbering authority | No |
| Published on your own domain | Yes, verified custom domains | github.com |
| Mirrored into your own git | Yes, as canonical JSON | No |
It runs on your infrastructure.
Postgres, Redis and an object store, on hardware you control and a network that never has to reach ours. Secrets stay under your own key, or in your own Vault.