Outrightly Docs

Quick Start

Get Outrightly running in under five minutes. The Free tier gives you 3 monitored stacks and full CVE matching — no card required. Starter and Pro plans add alert channels (email, Slack, webhook).

Create Your First Stack

A stack is a named collection of packages representing one service or application. You can have multiple stacks per account, one for each microservice, environment, or team. Outrightly monitors all of them independently and routes alerts based on which stack was affected.

Recommended naming convention: mirror your infrastructure names exactly. If your services are called api-gateway, data-pipeline, and mobile-backend in your deployment config, use those same names here. It makes it easy to route alerts to the right team members.

Understanding Alerts

An alert is generated when a CVE is published (or updated) that affects a package in your stack at the exact version you declared. Outrightly evaluates version range expressions from the NVD and OSV advisory databases and matches them against your pinned versions.

Each alert card includes:

• CVE ID and a direct link to the full NVD advisory
• CVSS score and severity classification (Critical / High / Medium / Low)
• Affected version range and the earliest patched version
• CISA KEV badge if the vulnerability is actively exploited in the wild
• The name of the stack and package that triggered the alert

Manual Entry

Use the package search interface inside the dashboard to add individual packages one at a time. Search by package name, select the ecosystem (npm, PyPI, Maven, etc.), and enter the version you are currently running.

Manual entry is best for a small number of critical packages that do not appear in a standard manifest file, such as infrastructure-level dependencies you manage directly.

File Upload

Drag and drop any of the following manifest files into the stack editor and Outrightly will parse and import all packages automatically. Duplicate packages across files are de-duplicated.

• package.json, package-lock.json, yarn.lockNode.js / npm / Yarn
• requirements.txt, Pipfile.lock, pyproject.tomlPython / pip
• go.mod, go.sumGo modules
• Cargo.toml, Cargo.lockRust / Cargo
• pom.xml, build.gradle, build.gradle.ktsJava / Maven / Gradle
• Gemfile, Gemfile.lockRuby / Bundler
• packages.config, *.csprojNuGet / .NET
• composer.json, composer.lockPHP / Composer

GitHub Sync

Connect your GitHub account and select a repository. Outrightly reads your dependency manifest files from the default branch and re-syncs daily. Any newly introduced package that has an active CVE triggers an immediate alert without you having to re-upload anything.

GitHub Sync requires only the read:contents scope on the repositories you select. Outrightly never writes to your repository; it reads only manifest and lock files.

Supported Ecosystems

Outrightly monitors two broad categories: package ecosystems (language-level dependencies managed by a package manager) and infrastructure software (servers, databases, runtimes, and system-level components tracked directly in the NVD and OSV databases by their CPE identifiers).

Package Ecosystems

Add these by uploading a manifest file or using manual entry with the ecosystem selector.

Infrastructure Software

Add these using manual entry: search by the software name and select the version you are running. Outrightly matches against NVD CVEs using CPE (Common Platform Enumeration) identifiers, which cover server software, system libraries, and operating system components just as precisely as package-level dependencies.

Alert Channels

Configure notification channels in Settings → Notifications. Available channels depend on your plan. Alert delivery is the primary differentiator between tiers.

Severity Thresholds

Set a minimum CVSS severity in Settings → Notifications. Alerts below this threshold are suppressed and stored silently in your alert history.

Frequency Settings

Choose how often you want to be notified. This setting controls non-Critical alerts. Critical severity and CISA KEV alerts always fire immediately, regardless of this setting.

• Real-time: alert fires the moment a matching CVE is published.
• Hourly digest: all matches in the last hour are batched into one message.
• Daily digest: one summary email per day, sent at 08:00 in your timezone.

AI Security Analysis

Every CVE detail page includes an AI Security Analysis panel. Click the button below the NVD description to expand a three-section breakdown specific to that vulnerability.

Remediation Workflow

When a CVE alert fires for your stack, open a remediation record to track the fix from discovery to closure. Each record moves through five stages:

Each stage transition is timestamped automatically. You can attach notes at any stage, useful for recording the patch PR number, the engineer who owns it, or a reason for deferral. All team members on your workspace can see the current status.

Team Workspaces

Invite teammates to your Outrightly workspace and share stacks, alerts, and remediation records across the whole team. Each member is assigned one of three roles:

Go to Settings → Teamto invite members by email. Invitees receive an email with a link to join the workspace. You can change a member's role or remove them at any time.

CI/CD Integration

CI/CD integration is available on the Pro plan using the API. You can query the CVE feed from any pipeline step to check for new high-severity vulnerabilities.

Query the CVE feed from a pipeline

Generate an API token from Settings → API Keys and use it to call the feed API. The example below queries recent critical CVEs:

# Example: fetch recent critical CVEs from the Outrightly feed
curl -s "https://outrightly.io/api/v1/feed?severity=critical&limit=20" \
  -H "Authorization: Bearer $OUTRIGHTLY_API_KEY"

# Returns a JSON array of CVE objects with id, severity, cvss, summary, published_at

Slack Integration

Go to Settings → Notifications → Slack and paste your Slack Incoming Webhook URL. Create one at api.slack.com/apps.

Each alert posts a structured message to your channel:

{
  "text": "Critical CVE matched in *production-api*",
  "blocks": [
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": "*CVE-2025-44228* | CVSS 9.8 | :red_circle: Critical\n*Package:* lodash@4.17.20 (npm)\n*Affected:* < 4.17.21 | *Patch:* 4.17.21\n*Stack:* production-api"
      }
    }
  ]
}

PagerDuty & Other On-Call Tools

Outrightly does not have a native PagerDuty integration today. The recommended approach is to configure a Pro-tier webhook and route it to PagerDuty, OpsGenie, or any on-call tool via a Zapier or Make.com automation. The webhook payload includes all the data you need: CVE ID, CVSS score, severity, affected stack and package, and a link to the alert detail page.

Webhooks

Configure a webhook endpoint in Settings → Notifications → Webhook. Outrightly sends a POST request to your endpoint with the following JSON body:

{
  "event": "alert.created",
  "alert": {
    "id": "alrt_01jxyz...",
    "cve_id": "CVE-2025-44228",
    "severity": "critical",
    "cvss_score": 9.8,
    "package": "lodash",
    "ecosystem": "npm",
    "affected_version": "4.17.20",
    "fixed_version": "4.17.21",
    "stack": {
      "id": "stk_01jxyz...",
      "name": "production-api"
    },
    "is_kev": false,
    "created_at": "2025-07-08T14:22:01Z"
  }
}

Every request includes an X-Outrightly-Signature header: an HMAC-SHA256 of the raw request body signed with your webhook secret. Verify this header before processing the payload.

const crypto = require('crypto')

function verify(body, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex')
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  )
}

API Authentication

API access is available on the Pro plan. Generate an API key from Settings → API Keys and include it as a Bearer token in the Authorization header. Keep your key secret and never commit it to source control.

curl https://outrightly.io/api/v1/feed \
  -H "Authorization: Bearer YOUR_API_KEY"

CVEs API

Get CVE feed

Returns recently published or updated CVEs. Supports filtering by severity.

# Get recent CVEs (all severities)
GET /api/v1/feed

# Filter by severity
GET /api/v1/feed?severity=critical
GET /api/v1/feed?severity=high

# Response: array of CVE objects
[
  {
    "id": "CVE-2025-44228",
    "severity": "critical",
    "cvss": 9.8,
    "summary": "...",
    "published_at": "2025-07-08T14:00:00Z",
    "is_kev": false
  }
]

Get a single CVE

Returns full details for a specific CVE by ID.

GET /api/v1/cves/CVE-2025-44228

# Response
{
  "id": "CVE-2025-44228",
  "severity": "critical",
  "cvss": 9.8,
  "summary": "...",
  "description": "...",
  "published_at": "2025-07-08T14:00:00Z",
  "is_kev": false,
  "affected": [ ... ]
}