Publish security advisories (CSAF)

The CRA asks you to share information about fixed vulnerabilities with your users. On paid plans, Provetry gives each product a public security page with its advisories, in the formats tools read.

1. On the product, open Advisories and public page.
2. New advisory: identifiers (CVE, GHSA…), affected versions, what users must do, a workaround if any, a credit with the reporter’s agreement.
3. Save: the draft stays private.
4. Publish a new revision when it is ready. Later changes become new revisions; a published advisory stays.
5. Open the page to make the public security page visible.

What is published

• The advisories as CSAF 2.0, signed with OpenPGP, with the provider metadata, index and hashes that CSAF tools expect.
• A VEX feed (OpenVEX) of the vulnerabilities you assessed as not affected or fixed: status, justification and component, never your explanations.
• A link to your disclosure policy.

Advisories are written in English, the language of CSAF tooling. Closing the page makes the address stop working until you open it again.