# GCVE BCP-05-X-04 - Vulnerability Handling and Advisory Publication State

**URL:** <https://discourse.ossbase.org/t/gcve-bcp-05-x-04-vulnerability-handling-and-advisory-publication-state/1136>\
**Category:** GCVE\
**Tags:** bcp-05\
**Created:** [October 4, 2026, 7:29am UTC](https://discourse.ossbase.org/t/gcve-bcp-05-x-04-vulnerability-handling-and-advisory-publication-state/1136 "2026-10-04T07:29:21Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [October 4, 2026, 7:29am UTC](https://discourse.ossbase.org/t/gcve-bcp-05-x-04-vulnerability-handling-and-advisory-publication-state/1136/1 "2026-10-04T07:29:22Z")

</div>

> **GCVE BCP-05-X-04 — Vulnerability Handling and Advisory Publication State**

Its purpose would be to represent the **current snapshot** , while BCP-05-X-03 remains the historical timeline.

Some state ideas:

- `not-public`
- `embargoed`
- `scheduled`
- `published`
- `withdrawn`
- `superseded`

The current challenge is to define embargoed. Means that a publication could be have done already done to a private group. So those state could be combined. We saw also case of publication which were limited to a trusted group and never going fully public.

The draft mode and alike must be also aligned with the vulnerability-lookup implementation. Prototype in vulnerability-lookup but a new rework is required.

---

_[View the full topic](https://discourse.ossbase.org/t/gcve-bcp-05-x-04-vulnerability-handling-and-advisory-publication-state/1136)._