Outrightly Docs

Quick Start

Get Outrightly running in under five minutes. You will need a Pro or Starter plan to access stack monitoring and real-time alerts. The Free tier lets you browse the public CVE feed without limits.

Create Your First Stack

A stack is a named collection of packages representing one service or application. You can have multiple stacks per account — one for each microservice, environment, or team. Outrightly monitors all of them independently and routes alerts based on which stack was affected.

Recommended naming convention: mirror your infrastructure names exactly. If your services are called api-gateway, data-pipeline, and mobile-backend in your deployment config, use those same names here. It makes it easy to route alerts to the right team members.

Understanding Alerts

An alert is generated when a CVE is published — or updated — that affects a package in your stack at the exact version you declared. Outrightly evaluates version range expressions from the NVD and OSV advisory databases and matches them against your pinned versions.

Each alert card includes:

• CVE ID and a direct link to the full NVD advisory
• CVSS score and severity classification (Critical / High / Medium / Low)
• Affected version range and the earliest patched version
• CISA KEV badge if the vulnerability is actively exploited in the wild
• The name of the stack and package that triggered the alert

Manual Entry

Use the package search interface inside the dashboard to add individual packages one at a time. Search by package name, select the ecosystem (npm, PyPI, Maven, etc.), and enter the version you are currently running.

Manual entry is best for adding a small number of critical packages — for example, a handful of infrastructure-level dependencies that do not appear in a standard manifest file.

File Upload

Drag and drop any of the following manifest files into the stack editor and Outrightly will parse and import all packages automatically. Duplicate packages across files are de-duplicated.

• package.json, package-lock.json, yarn.lockNode.js / npm / Yarn
• requirements.txt, Pipfile.lock, pyproject.tomlPython / pip
• go.mod, go.sumGo modules
• Cargo.toml, Cargo.lockRust / Cargo
• pom.xml, build.gradle, build.gradle.ktsJava / Maven / Gradle
• Gemfile, Gemfile.lockRuby / Bundler
• packages.config, *.csprojNuGet / .NET
• composer.json, composer.lockPHP / Composer

GitHub Sync

Connect your GitHub account and select a repository. Outrightly reads your dependency manifest files from the default branch and re-syncs daily. Any newly introduced package that has an active CVE triggers an immediate alert without you having to re-upload anything.

GitHub Sync requires only the read:contents scope on the repositories you select. Outrightly never writes to your repository and never reads application code — only manifest files.

Supported Ecosystems

Outrightly monitors two broad categories: package ecosystems (language-level dependencies managed by a package manager) and infrastructure software (servers, databases, runtimes, and system-level components tracked directly in the NVD and OSV databases by their CPE identifiers).

Package Ecosystems

Add these by uploading a manifest file or using manual entry with the ecosystem selector.

Infrastructure Software

Add these using manual entry — search by the software name and select the version you are running. Outrightly matches against NVD CVEs using CPE (Common Platform Enumeration) identifiers, which cover server software, system libraries, and operating system components just as precisely as package-level dependencies.

Alert Channels

Configure notification channels in Settings → Notifications. Available channels depend on your plan — alert delivery is the primary upgrade driver between tiers.

Severity Thresholds

Set a minimum CVSS severity in Settings → Notifications. Alerts below this threshold are suppressed and stored silently in your alert history.

Frequency Settings

Choose how often you want to be notified. This setting controls non-Critical alerts — Critical severity and CISA KEV alerts always fire immediately.

• Real-time — alert fires the moment a matching CVE is published.
• Hourly digest — all matches in the last hour are batched into one message.
• Daily digest — one summary email per day, sent at 08:00 in your timezone.

Slack Integration

Go to Settings → Notifications → Slack and paste your Slack Incoming Webhook URL. Create one at api.slack.com/apps.

Each alert posts a structured message to your channel:

{
  "text": "Critical CVE matched in *production-api*",
  "blocks": [
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": "*CVE-2025-44228* | CVSS 9.8 | :red_circle: Critical\n*Package:* lodash@4.17.20 (npm)\n*Affected:* < 4.17.21 | *Patch:* 4.17.21\n*Stack:* production-api"
      }
    }
  ]
}

PagerDuty Integration

Paste your PagerDuty Events API v2 integration key in Settings → Notifications → PagerDuty. Outrightly fires Critical and High severity alerts as PagerDuty incidents. The incident payload includes the CVE ID, CVSS score, affected stack, and a direct link to the alert detail page in Outrightly.

Webhooks

Configure a webhook endpoint in Settings → Notifications → Webhook. Outrightly sends a POST request to your endpoint with the following JSON body:

{
  "event": "alert.created",
  "alert": {
    "id": "alrt_01jxyz...",
    "cve_id": "CVE-2025-44228",
    "severity": "critical",
    "cvss_score": 9.8,
    "package": "lodash",
    "ecosystem": "npm",
    "affected_version": "4.17.20",
    "fixed_version": "4.17.21",
    "stack": {
      "id": "stk_01jxyz...",
      "name": "production-api"
    },
    "is_kev": false,
    "created_at": "2025-07-08T14:22:01Z"
  }
}

Every request includes an X-Outrightly-Signature header: an HMAC-SHA256 of the raw request body signed with your webhook secret. Verify this header before processing the payload.

const crypto = require('crypto')

function verify(body, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex')
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  )
}

API Authentication

All API requests require a Bearer token in the Authorization header. Generate an API key from Settings → API Keys. Keep your key secret and never commit it to source control.

curl https://api.outrightly.io/v1/stacks \
  -H "Authorization: Bearer ok_live_xxxxxxxxxxxxxxxx"

Stacks API

CVEs API

Rate Limits

The API allows 300 requests per minute per API key. Rate limit status is included in every response header.

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 297
X-RateLimit-Reset: 1720454400

If you exceed the limit, the API returns 429 Too Many Requests. Wait until the timestamp in X-RateLimit-Reset before retrying.