diff --git a/app/__init__.py b/app/__init__.py
index 53a874c..2d6d694 100644
--- a/app/__init__.py
+++ b/app/__init__.py
@@ -166,7 +166,8 @@ async def project(project: str):
         project_name=project,
         debt_constant=statistics.DEBT_CONSTANT,
         sections=sections,
-        show_subproject=project in config.get().pmcs_with_subprojects)
+        show_subproject=project in config.get().pmcs_with_subprojects,
+        is_unreleased=project in config.get().unreleased_pmcs)
 
 @CLIENT.route("/api/project/<project>/reports")
 async def project_reports_api(project: str):
diff --git a/app/config.py b/app/config.py
index a82e830..6657ca0 100644
--- a/app/config.py
+++ b/app/config.py
@@ -38,7 +38,7 @@ class AppConfig(pydantic.BaseModel):
     state_dir: str
     """Local persistent data"""
 
-    old_cve_close_dates: dict[str, date]
+    old_cve_close_dates: dict[str, date] = {}
     """Some manual exceptions from before we had vulnogram, to prevent them from getting necromanced in the stats"""
 
     pmcs_with_security_emails: list[str] = []
@@ -53,6 +53,9 @@ class AppConfig(pydantic.BaseModel):
     pmcs_with_subprojects: list[str] = []
     """PMCs whose reports are split across subprojects."""
 
+    pmcs_without_releases: list[str] = []
+    """PMCs that do not publish software releases and therefore do not issue CVEs."""
+    
     server: ServerConfig = ServerConfig()
 
     @property
diff --git a/app/templates/project.html b/app/templates/project.html
index 8b4007f..650e933 100644
--- a/app/templates/project.html
+++ b/app/templates/project.html
@@ -62,13 +62,17 @@ <h3>{{ title }}
               <div><a href="https://cveprocess.apache.org/cve5/{{cve}}">{{ cve }}</a></div>
             {%- endfor -%}
             {%- if report.state == 'confirmed' and not report.cves -%}
-              <div><a href="https://cveprocess.apache.org/allocatecve?pmc={{ project_name|urlencode }}&amp;title={{ report.sanitized_title|urlencode }}">allocate CVE</a></div>
+              {%- if is_unreleased -%}
+                <span class="text-muted" title="This project is not released and does not require CVEs. Credit reporter in commit messages or project acknowledgments.">no CVE required</span>
+              {%- else -%}
+                <div><a href="https://cveprocess.apache.org/allocatecve?pmc={{ project_name|urlencode }}&amp;title={{ report.sanitized_title|urlencode }}">allocate CVE</a></div>
+              {%- endif -%}
             {%- endif -%}
           </td>
-          <td class="reports-reporter">
+          <td class="reports-reporter ">
             {% if report.reporter %}
               <span class="reporter-initials"
-                    style="background-color: {{ report.reporter.color }};"
+                    style="background-color: {{ report.reporter.color }}"
                     title="{{ report.reporter.tooltip }}">{{ report.reporter.initials }}</span>
             {% endif %}
           </td>
diff --git a/config.yaml.example b/config.yaml.example
index d16533e..68721ce 100644
--- a/config.yaml.example
+++ b/config.yaml.example
@@ -8,3 +8,6 @@ pmcs_with_security_emails:
   - ambari
 pmcs_with_subprojects:
   - commons
+pmcs_without_releases:
+  - whimsy
+  - infrastructure