EmbargoGate API Overview
Why EmbargoGate?
Section titled “Why EmbargoGate?”Because a single premature vulnerability leak turns an API gateway into a front-page scandal. EmbargoGate enforces cryptographic intake and strict state-machine governance so your coordinated disclosure stays behind the gate until patch day.
Summary
Section titled “Summary”EmbargoGate API is a Coordinated Vulnerability Disclosure (CVD) and SBOM ingestion engine. This site is its open reference specification. It covers API governance, STRIDE threat modeling, OpenVEX advisory management, and automated disclosure pipelines aligned with the EU Cyber Resilience Act (CRA) and NIST SP 800-161.
The specification
Section titled “The specification”| Area | What it covers |
|---|---|
| Security considerations | STRIDE threat matrix for intake, lifecycle, and delivery, with mitigations such as Sigstore Cosign attestation, SHA-256 digests, time-bound ABAC, and parser sandboxing |
| Core concepts | The advisory state machine (SUBMITTED → VERIFIED → EMBARGOED → DISCLOSED / REJECTED) and its CRA and NIST context |
| Endpoints | Endpoint contract and OAuth 2.0 scope registry for SBOM ingestion, OpenVEX advisories, and webhooks |
| Errors | RFC 7807 application/problem+json error examples |
| Authentication and Webhooks | mTLS, OAuth 2.0, and time-bound ABAC; HMAC-SHA256 webhook signature verification |
Where to start
Section titled “Where to start”- Security reviewers: begin with Security considerations.
- Integrators: begin with Authentication, then Endpoints.