diff --git a/data/excluded/GO-2024-2539.yaml b/data/excluded/GO-2024-2539.yaml
deleted file mode 100644
index a3dc1df..0000000
--- a/data/excluded/GO-2024-2539.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-id: GO-2024-2539
-excluded: EFFECTIVELY_PRIVATE
-modules:
-    - module: github.com/mattermost/mattermost-plugin-jira
-cves:
-    - CVE-2024-23319
-ghsas:
-    - GHSA-4fp6-574p-fc35
diff --git a/data/osv/GO-2024-2539.json b/data/osv/GO-2024-2539.json
new file mode 100644
index 0000000..6bec566
--- /dev/null
+++ b/data/osv/GO-2024-2539.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.3.1",
+  "id": "GO-2024-2539",
+  "modified": "0001-01-01T00:00:00Z",
+  "published": "0001-01-01T00:00:00Z",
+  "aliases": [
+    "CVE-2024-23319",
+    "GHSA-4fp6-574p-fc35"
+  ],
+  "summary": "Cross-site request forgery via logout button in github.com/mattermost/mattermost-plugin-jira",
+  "details": "Cross-site request forgery via logout button in github.com/mattermost/mattermost-plugin-jira",
+  "affected": [
+    {
+      "package": {
+        "name": "github.com/mattermost/mattermost-plugin-jira",
+        "ecosystem": "Go"
+      },
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.1.2-0.20230830170046-f4cf4c6de017"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "imports": [
+          {
+            "path": "github.com/mattermost/mattermost-plugin-jira/server",
+            "symbols": [
+              "Plugin.httpOAuth1aDisconnect",
+              "Plugin.initializeRouter"
+            ]
+          }
+        ]
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23319"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/mattermost/mattermost-plugin-jira/commit/f4cf4c6de017ef6aa4428d393b78f418dd84cd8e"
+    },
+    {
+      "type": "WEB",
+      "url": "https://mattermost.com/security-updates"
+    }
+  ],
+  "database_specific": {
+    "url": "https://pkg.go.dev/vuln/GO-2024-2539"
+  }
+}
\ No newline at end of file
diff --git a/data/reports/GO-2024-2539.yaml b/data/reports/GO-2024-2539.yaml
new file mode 100644
index 0000000..2fce8b1
--- /dev/null
+++ b/data/reports/GO-2024-2539.yaml
@@ -0,0 +1,24 @@
+id: GO-2024-2539
+modules:
+    - module: github.com/mattermost/mattermost-plugin-jira
+      versions:
+        - fixed: 1.1.2-0.20230830170046-f4cf4c6de017
+      non_go_versions:
+        - fixed: 4.0.0-rc2
+      vulnerable_at: 1.1.2-0.20230829214939-57856e474934
+      packages:
+        - package: github.com/mattermost/mattermost-plugin-jira/server
+          symbols:
+            - Plugin.httpOAuth1aDisconnect
+            - Plugin.initializeRouter
+summary: |-
+    Cross-site request forgery via logout button in
+    github.com/mattermost/mattermost-plugin-jira
+cves:
+    - CVE-2024-23319
+ghsas:
+    - GHSA-4fp6-574p-fc35
+references:
+    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-23319
+    - fix: https://github.com/mattermost/mattermost-plugin-jira/commit/f4cf4c6de017ef6aa4428d393b78f418dd84cd8e
+    - web: https://mattermost.com/security-updates
diff --git a/doc/format.md b/doc/format.md
index 33267cf..b501c6e 100644
--- a/doc/format.md
+++ b/doc/format.md
@@ -103,6 +103,22 @@
 module maintainers that do not conform to [Go's module
 version conventions](https://go.dev/doc/modules/version-numbers).
 
+An example is data/reports/GO-2024-2539.yaml, whose vulnerable versions
+are listed as:
+
+```yaml
+versions:
+  - fixed: 1.1.2-0.20230830170046-f4cf4c6de017
+non_go_versions:
+  - fixed: 4.0.0-rc2
+vulnerable_at: 1.1.2-0.20230829214939-57856e474934
+```
+
+The [GHSA](https://github.com/advisories/GHSA-4fp6-574p-fc35) for this report
+lists a fixed version, `4.0.0-rc2`, which is not known to the module proxy.
+To encode this, we list that version as a "non-Go" version, and put the
+pseudo-version corresponding to the fix commit in the regular `versions` section.
+
 ### `module.vulnerable_at`
 
 type `string`