How it compares

The question is where the record lives

Everything on this page can draft an advisory, record affected versions, and get a CVE assigned. That is not the axis. The axis is who holds the record, what it is attached to, who can read it before it is public, and what happens to it when you stop using the tool.

GAdvisory answers those one way: your database, attached to a project hierarchy rather than a repository, on a hostname you own, mirrored into your own git. That answer costs you a deployment to run and a set of integrations you would otherwise get for free, and whether that trade is worth making depends entirely on what you ship and to whom.

When each is the right answer

Use GitHub Security Advisories if your project is on GitHub, your users consume it as a dependency, and nothing about your disclosure record is more sensitive than the code it describes. It is free, it needs no setup, and it reaches your users through channels GAdvisory has no access to.

Use a VDP platform if the hard part is receiving reports rather than publishing them. They own the researcher relationship, the triage capacity and the payments, none of which is what GAdvisory is for. They also work alongside it rather than instead of it.

Use GAdvisory when the record itself needs to be yours: because you ship to air-gapped customers, because you hold or want your own numbering remit, because your advisories must be published under your own brand and domain, or because a regulator will ask you where the data is and who processes it.