Security Advisories

Write, publish and distribute security advisories from the same place as your SBOMs and VEX. Per-product gating, CSAF 2.0 feeds, security.txt and CRA-ready disclosure, on your own Trust Center.

Every new CVE turns into the same customer question: are we affected? Answer it once, in a proper advisory, where your customers and their tools already look.

A Security Advisory Page Your PSIRT Will Actually Use

Advisories live next to the SBOMs, findings and VEX they are about, so writing one takes minutes, not a scramble across five tools

Write It Properly

Summary, CVSS score and vector, CVE and OSV references, and affected and fixed version ranges for every product the issue touches.

An Honest Timeline

Every update is dated and shows the gap since the last one. That gap is what customers judge your incident handling on.

Published to Your Trust Center

One click puts it on your branded Trust Center, on your own domain, with a filterable advisory index customers can search by product and severity.

Embargoes

Gated Advisories That Are Actually Gated

Some advisories are for everyone. Some are only for the customers running the affected product, under NDA, until the fix ships. Each advisory has one of three visibility states:

✓
Public Readable by anyone once it leaves draft, indexed by search engines, and included in your CSAF feed.
✓
Gated Readable only by people with approved access who can already see at least one affected product. A customer of one product never learns about an embargoed issue in another.
✓
Private Never leaves your workspace, whatever its status.

Discretion

Built Not to Leak

For an embargoed vulnerability, the fact that an advisory exists is itself sensitive. sbomify treats it that way.

✓
404, not 403 A reader who may not see a gated advisory gets "not found", not "forbidden", so its existence is not confirmed.
✓
Products counted, not named When an advisory spans several products, readers only see the names of the products they are entitled to.
✓
Kept out of search Gated pages are noindex, nofollow, and never appear in the public CSAF distribution.

Machine-Readable

CSAF 2.0 Out of the Box

Enterprise customers don't read advisories one by one. Their vulnerability management tools pull them in automatically and match them against their inventory. sbomify publishes every public advisory as a CSAF 2.0 document, ready to be pulled in.

✓
CSAF provider metadata Served at /.well-known/csaf/provider-metadata.json on your Trust Center domain, the entry point CSAF aggregators look for.
✓
ROLIE feed A TLP:WHITE feed listing every public advisory, so new ones are picked up without anyone sending an email.
✓
security.txt with a CSAF pointer Your RFC 9116 security.txt links to the CSAF provider automatically, laid out as BSI TR-03183-3 expects.
✓
VEX vocabulary, mapped Product status uses the CISA VEX-to-CSAF crosswalk, so not affected, under investigation and fixed mean the same thing in every format.

Your Trust Center domain

/.well-known/security.txt
/.well-known/csaf/provider-metadata.json
/.well-known/csaf/white/feed-tlp-white.json
/.well-known/csaf/white/<year>/<advisory>.json

Cyber Resilience Act

Vulnerability Handling the CRA Can Audit

The EU Cyber Resilience Act makes disclosure an obligation. Annex I Part II asks manufacturers to publish information about fixed vulnerabilities, run a coordinated disclosure policy and give researchers a contact. Article 14 adds reporting of actively exploited vulnerabilities from 11 September 2026.