doesithaveamoat?
Check your startup
PostizRun your social media on autopilot with AI agentsRanlaYour AI growth engineer: Search + Ads + Reddit + EmailYouTube Video Download APIReliable 99.995% success over last 30 daysPostizRun your social media on autopilot with AI agentsRanlaYour AI growth engineer: Search + Ads + Reddit + EmailYouTube Video Download APIReliable 99.995% success over last 30 days
7/10

GAVR

gavr.gadvisory.org

Does GAVR have a moat?

No.

12/100 · Moatless

“The registry is a weekend build. A namespace only matters if CVE-scale authorities and scanners adopt it, and GAVR has 3 bodies, one of them its own.”

Code to copy

2 weeks

Moat to cross

years

Market

Crowded market

Share on X
Moat depth
MoatlessShallowReal

Revenue not verified. Founders can list on TrustMRR to show it here.

01/The verdict

A public registry of permanent vulnerability IDs (GAVR-xxxx). Each ID resolves to a signed record and names the accredited body behind it. No paying customers are visible yet.

What exists today is a lookup site, a spec, a signing key and data dumps. A capable builder can copy all of it in about two weeks. The real prize would be a network of accredited authorities and consumers that cite the IDs, and that is not there yet. The directory lists 3 active bodies: Gelhaus Solutions (the founder's own company), a 'Last Resort' fallback, and Postiz (the founder's employer).

02/1 moat

Network effects

Shallow

Time won't do it

The value of an ID namespace comes from many authorities issuing and many scanners and databases citing it. The directory shows only 3 accredited bodies, and two are tied to the founder (Gelhaus Solutions, Postiz).

To cross it: A challenger would need to win real vulnerability authorities and tool vendors, which is slow and uncertain, and it must also beat CVE, EUVD and GCVE for attention.

03/The gap

Easy to copy

  • The registry site, resolver and ID format (a weekend or two of work)
  • Signed records with a countersignature and a published key (standard cryptography)
  • The spec and JSON schema, which are public and easy to fork
  • The authority directory page and data dumps

How you'd go after it

  • Fork the spec and run a rival namespace under a neutral body or foundation, which is more credible than one individual's registry.
  • Offer authorities the same service inside existing ecosystems that already have reach, such as GCVE (CIRCL), EUVD (ENISA), GitHub advisories or OSV.
  • Win open-source projects with a bundled CNA-like service plus tooling that scanners already ingest.
  • Get Vulners, OSV and scanner vendors to ingest your IDs first, since consumption drives authority sign-ups.

04/Build against it?

Stay away

Identifier schemes only work at scale, and CVE, EUVD and GCVE already compete for the same role. Only build it with an edge: a neutral governing body or a big set of committed authorities and scanners from day one.

Already selling this:CVE (MITRE / CVE Foundation)EUVD (ENISA)GCVE (CIRCL)GitHub Security Advisories (GHSA)OSVGlobal Security Database (GSD)

05/Receipts

Checked 3h ago by Claude Sonnet 5.5 on high effort, with web search. Confidence: medium.

Does yours?

Paste your website. You get your score in about a minute.