Operating as a numbering authority
GAdvisory can request identifiers from a registry on your behalf, or mint them under a remit of your own. This is what each of those means in practice, what it costs you operationally, and the guard rails around the one action in the product that cannot be undone.
Two different jobs called the same thing
Assigning identifiers to vulnerabilities in your own products is a distinct responsibility from writing advisories about them. A CVE Numbering Authority holds a remit from the CVE Program and assigns CVE ids inside it. A GCVE Numbering Authority holds a remit in the GCVE namespace and assigns identifiers there without needing anybody's permission per identifier.
Most organisations start by having somebody else assign, and take the remit on later, usually when the volume or the disclosure timing makes waiting on a third party the bottleneck. GAdvisory supports both, and moving between them does not mean moving your advisories.
Requesting a CVE
Three providers are supported: MITRE, CVE Services, and GitHub acting as a CNA. Each is configured per scope with its own credentials, so a group can publish through one and a project beneath it through another.
Assignment and publication are separate steps, deliberately. Reserving an identifier gets you a CVE id to use in coordination while the advisory is still embargoed; publishing pushes the record. A withdrawal after publication is a third action, and for the registries that support it the identifier is retired rather than freed, because an identifier that was cited cannot be un-cited.
Nothing irreversible happens without an approval
Minting a CVE cannot be undone. So every action that would reach a registry goes through a queue first: somebody with the standing to decide sees exactly what would be sent, and approves that. The approval is bound to the document, not to the request, so if the advisory changes afterwards the approval no longer applies and the queue says so.
An approval authorises one run of one action. Approving a reservation does not authorise a publication months later, and approving a publication does not authorise the withdrawal. Each is asked for and answered on its own.
Underneath that, assignment rests on a database constraint rather than on the application being careful: one live reservation per advisory, per configuration, per registry. Two people pressing the button at the same moment produce one identifier, and a crash between minting and recording leaves a claim that is reconciled rather than a second CVE.
Test mode reaches the test registry
It is a real round trip to the provider's test environment, not a simulation and not a no-op. That is worth stating plainly because the opposite was once implied here and it was expensive: an operator who believes nothing is being sent will press the button to find out.
Only the providers that actually run a test registry can be put in test mode, and the configuration form refuses the combination rather than accepting it and quietly publishing to production.
Minting your own identifiers
GCVE is a namespace in which an accredited numbering authority assigns identifiers itself, with no per-identifier request to anybody. GAdvisory implements the relevant practices: identifier allocation, the record format, the publication feed the aggregators collect, and the conformance requirements around them.
The operational consequence is the one worth planning for. A GCVE identifier must never be reused and never reassigned, so allocation here is deliberately hard to undo: the identifier is written once, the reservation is never deleted, and withdrawing an advisory drops it from the feed while keeping the identifier spent. That is the correct behaviour and it is not reversible by an operator.
A numbering authority is bound to a scope, so a group can hold the remit and its projects inherit it, or a single project can hold one of its own. There is a bulk pass for an existing corpus, which previews before it writes, because the alternative is discovering a mistake after several hundred permanent identifiers exist.
Mirroring to GitHub, with consent
An advisory can be mirrored to a GitHub repository as a GHSA. Drafts are free: a GHSA draft is private to the repository's operators, assigns nothing and can be deleted, so iterating on one costs nothing and needs no ceremony.
Publishing one live is the irreversible half, and it needs explicit per-advisory consent recorded against that pair. Consent persists for subsequent syncs and can be revoked. Automatic publication on advisory publish deliberately does not apply to GitHub.
Related
If you hold your own remit, the question of how anybody verifies a record you issued is the next one, and it is what the GAVR network exists to answer.