nongnu.org is the domain for Savannah, a long-established free software development platform run by the GNU Project. While the organization behind it is well respected and the domain is over two decades old, the site currently has a serious security problem: its SSL certificate is misconfigured. That means any attempt to visit the site over HTTPS will fail, and if you do get through on HTTP, your connection isn't encrypted. For a platform that requires users to log in, register, and submit code, this is a major red flag. Legitimate open-source project hosts like GitHub and GitLab always have valid certificates. Until this is fixed, you shouldn't enter any personal information or create an account on nongnu.org. The underlying service is real, but the broken security makes it unsafe to use right now. If the certificate gets sorted out, the site's long history and clear ownership would make it trustworthy again. Keep an eye on the SSL renewal before trusting it with your data.
In plain English
This site has a critical flaw that makes it untrustworthy right now. The SSL certificate is invalid, so you can't reach the site over a secure HTTPS connection. That's a dangerous situation for a platform where users log in and manage accounts.
What you should do now
Don't panic. These steps limit the damage, and the sooner you take them the better.
Don't enter any details
No passwords, card numbers or personal information — even if the site looks professional.
Close the tab
Especially if you got here from an email, text message or social media ad.
Already paid? Call your bank
Contact your bank or card provider right away. They can often stop or reverse a recent payment.
Warn others
Report the site and share this check with anyone who sent you the link.
Where the score comes from
The SSL certificate is invalid for nongnu.org, which makes the site inaccessible over HTTPS. That's a critical flaw for any site that asks users to log in or register.
The domain has been registered for over two decades under GNU Project, a well-known free software organization. This gives strong confidence in who runs the site.
No blacklist presence and a moderate global traffic rank confirm that this is a long-standing, legitimate software development hub without red flags.
The site clearly identifies itself as Savannah, part of GNU, with an about page and contact information. It's as transparent as you'd expect for a non-commercial open-source project.
Missing privacy policy and terms of service is a gap for a platform that manages user registrations and personal data. While common for small open-source projects, it's still a concern.
Beyond the SSL certificate problem, the site loads slowly and lacks DNSSEC. The invalid certificate makes secure access impossible, which is the biggest infrastructure weakness.
What we checked
Think this verdict is wrong?
Site owners can request a fresh scan. Scores update automatically as signals change.