Outrightly Docs

Quick Start

Get Outrightly running in under five minutes. You will need a Pro or Starter plan to access stack monitoring and real-time alerts. The Free tier lets you browse the public CVE feed without limits.

Create Your First Stack

A stack is a named collection of packages representing one service or application. You can have multiple stacks per account, one for each microservice, environment, or team. Outrightly monitors all of them independently and routes alerts based on which stack was affected.

Recommended naming convention: mirror your infrastructure names exactly. If your services are called api-gateway, data-pipeline, and mobile-backend in your deployment config, use those same names here. It makes it easy to route alerts to the right team members.

Understanding Alerts

An alert is generated when a CVE is published (or updated) that affects a package in your stack at the exact version you declared. Outrightly evaluates version range expressions from the NVD and OSV advisory databases and matches them against your pinned versions.

Each alert card includes:

• CVE ID and a direct link to the full NVD advisory
• CVSS score and severity classification (Critical / High / Medium / Low)
• Affected version range and the earliest patched version
• CISA KEV badge if the vulnerability is actively exploited in the wild
• The name of the stack and package that triggered the alert

Manual Entry

Use the package search interface inside the dashboard to add individual packages one at a time. Search by package name, select the ecosystem (npm, PyPI, Maven, etc.), and enter the version you are currently running.

Manual entry is best for a small number of critical packages that do not appear in a standard manifest file, such as infrastructure-level dependencies you manage directly.

File Upload

Drag and drop any of the following manifest files into the stack editor and Outrightly will parse and import all packages automatically. Duplicate packages across files are de-duplicated.

• package.json, package-lock.json, yarn.lockNode.js / npm / Yarn
• requirements.txt, Pipfile.lock, pyproject.tomlPython / pip
• go.mod, go.sumGo modules
• Cargo.toml, Cargo.lockRust / Cargo
• pom.xml, build.gradle, build.gradle.ktsJava / Maven / Gradle
• Gemfile, Gemfile.lockRuby / Bundler
• packages.config, *.csprojNuGet / .NET
• composer.json, composer.lockPHP / Composer

GitHub Sync

Connect your GitHub account and select a repository. Outrightly reads your dependency manifest files from the default branch and re-syncs daily. Any newly introduced package that has an active CVE triggers an immediate alert without you having to re-upload anything.

GitHub Sync requires only the read:contents scope on the repositories you select. Outrightly never writes to your repository; it reads only manifest and lock files.

Supported Ecosystems

Outrightly monitors two broad categories: package ecosystems (language-level dependencies managed by a package manager) and infrastructure software (servers, databases, runtimes, and system-level components tracked directly in the NVD and OSV databases by their CPE identifiers).

Package Ecosystems

Add these by uploading a manifest file or using manual entry with the ecosystem selector.

Infrastructure Software

Add these using manual entry: search by the software name and select the version you are running. Outrightly matches against NVD CVEs using CPE (Common Platform Enumeration) identifiers, which cover server software, system libraries, and operating system components just as precisely as package-level dependencies.

Alert Channels

Configure notification channels in Settings → Notifications. Available channels depend on your plan. Alert delivery is the primary differentiator between tiers.

Severity Thresholds

Set a minimum CVSS severity in Settings → Notifications. Alerts below this threshold are suppressed and stored silently in your alert history.

Frequency Settings

Choose how often you want to be notified. This setting controls non-Critical alerts. Critical severity and CISA KEV alerts always fire immediately, regardless of this setting.

• Real-time: alert fires the moment a matching CVE is published.
• Hourly digest: all matches in the last hour are batched into one message.
• Daily digest: one summary email per day, sent at 08:00 in your timezone.

AI Security Analysis

Every CVE detail page includes an AI Security Analysis panel. Click the button below the NVD description to expand a three-section breakdown specific to that vulnerability.

Remediation Workflow

When a CVE alert fires for your stack, open a remediation record to track the fix from discovery to closure. Each record moves through five stages:

Each stage transition is timestamped automatically. You can attach notes at any stage, useful for recording the patch PR number, the engineer who owns it, or a reason for deferral. All team members on your workspace can see the current status.

Team Workspaces

Invite teammates to your Outrightly workspace and share stacks, alerts, and remediation records across the whole team. Each member is assigned one of three roles:

Go to Settings → Teamto invite members by email. Invitees receive an email with a link to join the workspace. You can change a member's role or remove them at any time.

CI/CD Integration

Use Outrightly in your pipeline to block deployments when your stack has unmitigated Critical or High CVEs. No agent or sidecar required, the integration uses your existing API token.

GitHub Actions

Add the outrightly/scan-action step to any workflow. The step queries your stack by ID and fails the workflow if unmitigated vulnerabilities at or above your threshold are found.

# .github/workflows/security.yml
name: Security Gate
on: [push, pull_request]

jobs:
  cve-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: outrightly/scan-action@v1
        with:
          api-key: ${{ secrets.OUTRIGHTLY_API_KEY }}
          stack-id: ${{ vars.OUTRIGHTLY_STACK_ID }}
          severity-threshold: HIGH   # fail on HIGH or CRITICAL
          fail-on-match: true

Generic CI (REST API)

For GitLab CI, Bitbucket Pipelines, or any other CI system, call the /v1/cves/match endpoint directly and check hasVulnerabilities in the response:

# Read lock file packages and query Outrightly
RESULT=$(curl -s -X GET https://api.outrightly.io/v1/alerts \
  -H "Authorization: Bearer $OUTRIGHTLY_API_KEY" \
  -G --data-urlencode "stackId=$OUTRIGHTLY_STACK_ID" \
     --data-urlencode "severity=HIGH" \
     --data-urlencode "status=unread")

COUNT=$(echo "$RESULT" | jq '.total')
if [ "$COUNT" -gt "0" ]; then
  echo "Blocking deploy: $COUNT unmitigated HIGH/CRITICAL CVEs found"
  exit 1
fi

Slack Integration

Go to Settings → Notifications → Slack and paste your Slack Incoming Webhook URL. Create one at api.slack.com/apps.

Each alert posts a structured message to your channel:

{
  "text": "Critical CVE matched in *production-api*",
  "blocks": [
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": "*CVE-2025-44228* | CVSS 9.8 | :red_circle: Critical\n*Package:* lodash@4.17.20 (npm)\n*Affected:* < 4.17.21 | *Patch:* 4.17.21\n*Stack:* production-api"
      }
    }
  ]
}

PagerDuty Integration

Paste your PagerDuty Events API v2 integration key in Settings → Notifications → PagerDuty. Outrightly fires Critical and High severity alerts as PagerDuty incidents. The incident payload includes the CVE ID, CVSS score, affected stack, and a direct link to the alert detail page in Outrightly.

Webhooks

Configure a webhook endpoint in Settings → Notifications → Webhook. Outrightly sends a POST request to your endpoint with the following JSON body:

{
  "event": "alert.created",
  "alert": {
    "id": "alrt_01jxyz...",
    "cve_id": "CVE-2025-44228",
    "severity": "critical",
    "cvss_score": 9.8,
    "package": "lodash",
    "ecosystem": "npm",
    "affected_version": "4.17.20",
    "fixed_version": "4.17.21",
    "stack": {
      "id": "stk_01jxyz...",
      "name": "production-api"
    },
    "is_kev": false,
    "created_at": "2025-07-08T14:22:01Z"
  }
}

Every request includes an X-Outrightly-Signature header: an HMAC-SHA256 of the raw request body signed with your webhook secret. Verify this header before processing the payload.

const crypto = require('crypto')

function verify(body, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex')
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  )
}

API Authentication

All API requests require a Bearer token in the Authorization header. Generate an API key from Settings → API Keys. Keep your key secret and never commit it to source control.

curl https://api.outrightly.io/v1/stacks \
  -H "Authorization: Bearer ok_live_xxxxxxxxxxxxxxxx"

Stacks API

CVEs API

Rate Limits

The API allows 300 requests per minute per API key. Rate limit status is included in every response header.

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 297
X-RateLimit-Reset: 1720454400

If you exceed the limit, the API returns 429 Too Many Requests. Wait until the timestamp in X-RateLimit-Reset before retrying.