GAdvisory

Does GAdvisory have a moat?

No.

15/100 · Moatless

“The advisory app is a month of work. The only real pull is one engineer's tie to Postiz, and rivals like Vulnogram and Vulnerability-Lookup are free.”

Code to copy

1 month

Moat to cross

3 months

Market

A few rivals

Share on X

Moat depth

MoatlessShallowReal

Revenue not verified. Founders can list on TrustMRR to show it here.

01/The verdict

Self-hosted advisory database and CNA workflow, an alternative to GitHub Security Advisories. It assigns CVE and GCVE IDs, publishes on the user's own domain and mirrors records to git. It is built by one engineer, and no pricing or paying customers were found.

The product is a standard web stack: NestJS, Next.js, Postgres, Redis, MinIO and Meilisearch. It wraps public CVE Services and GCVE specs that anyone can use, and a capable builder could rebuild it in about a month. The one real asset is that its author runs security at Postiz (about 26.6k GitHub stars), and Postiz already takes reports through GAdvisory. That is one reference customer, not a moat. Free tools from CIRCL and CVE.org cover much of the same ground. Research was cut short, so confidence is low.

02/1 moat

Distribution

Shallow

~4 mo to cross

The author, Enno Gelhaus, is Chief Operations & Security Officer at Postiz. Postiz's SECURITY.md sends all reports to GAdvisory, and its advisories are published on gadvisory.org. That gives visibility to a popular open-source project.

To cross it: Win a few visible open-source projects as showcase users, or go through the same Postiz-sized communities with a free hosted tier.

03/The gap

Easy to copy

The advisory workflow itself: drafts, CVSS, version ranges, embargoes and publishing, which GitHub Security Advisories already do.
CVE Services, MITRE and GCVE integration, because these are public APIs and open specs.
Git mirroring and custom-domain portals, which are ordinary engineering.
The GAVR federation spec, which has no adoption beyond its author yet.

How you'd go after it

Offer a hosted, free-to-start Vulnogram or Vulnerability-Lookup bundle that open-source maintainers can set up in an afternoon.
Add advisory publishing to GitLab or Gitea, or to existing CI and SBOM tools that already hold the repos.
Pitch EU regulated vendors, who face Cyber Resilience Act disclosure duties, on a managed CNA service with the paperwork handled.
Build on CIRCL's reference implementation and ride the GCVE push for decentralised IDs.

04/Build against it?

Only with an edge

Go only with an edge such as a wedge into EU Cyber Resilience Act compliance or an existing base of maintainers. Alone, the code is easy to copy and the free alternatives are good enough.

Already selling this:GitHub Security AdvisoriesVulnogramVulnerability-Lookup (CIRCL)GitLab Security AdvisoriesCVE Services portal (CVE.org)OSV / Red Hat CNA

05/Receipts

Checked 3h ago by Claude Sonnet 5.5 on high effort, with web search. Confidence: low.

Does yours?

Paste your website. You get your score in about a minute.