Question 1

What exactly does Outrightly do?

Accepted Answer

It watches the packages and infrastructure you are actually running against every major CVE database. The moment a vulnerability is published that matches your specific stack and version, you get alerted via email, Slack, or webhook. No alerts about packages you do not use.

Question 2

What does "stack" mean and how granular is it?

Accepted Answer

A stack is any named collection of software components you define. It could be your entire product, a single microservice, a client environment, or a department toolchain. You can have multiple stacks, each monitored independently.

Question 3

How do you detect what is in my stack?

Accepted Answer

Three ways: (1) You upload a dependency file: package.json, requirements.txt, go.mod, Cargo.toml, Gemfile.lock, pom.xml, and more. We parse it and extract every package and version. (2) You connect a GitHub repo and we read dependency files directly on a daily sync. (3) You enter a domain and we scan it, detecting web servers, frameworks, CMS versions, and runtime environments.

Question 4

What CVE databases do you pull from?

Accepted Answer

Four sources, all monitored continuously: NVD (the US government authoritative CVE source with CVSS scores), CISA KEV (confirmed actively exploited vulnerabilities), OSV.dev (package-level vulnerability data with exact version ranges for 10+ ecosystems), and the GitHub Advisory Database.

Question 5

What is CISA KEV and why does it matter?

Accepted Answer

CISA maintains a catalog of CVEs with confirmed active exploitation in the wild. These are not theoretical risks; they are vulnerabilities real attackers are using right now. We alert on KEV additions for your stack in under 2 minutes from the moment CISA publishes them.

Question 6

How fast are alerts?

Accepted Answer

We poll all four CVE sources every 30 minutes. For CISA KEV specifically, we have a dedicated watcher that detects additions in under 2 minutes. So in the worst case, you know about a new CVE within 30 minutes of publication.

Question 7

How precise is the version matching? Will I get false positives?

Accepted Answer

Version matching follows OSV version range spec, which covers exact versions, semver ranges, and ecosystem-specific versioning. A CVE affecting log4j 2.14.0 through 2.16.0 will not trigger an alert if you are running 2.17.1. False positives from already-patched versions are by design near-zero. Note: a small number of false positives can occur for distribution-backported patches (where a vendor backports a fix without changing the version string, e.g. RHEL or Debian packages) or when OSV advisory data itself contains a range error. These are upstream data quality issues we cannot fully eliminate.

Question 8

What ecosystems and package managers do you support?

Accepted Answer

npm/Node.js, PyPI/Python, Maven/Java, Go modules, Cargo/Rust, RubyGems, NuGet/.NET, Composer/PHP, Hex/Elixir, and Pub/Dart. Plus infrastructure components detected via domain scanning: nginx, Apache, CDN configs, web frameworks, CMS versions, and more.

Question 9

What does the domain scan find?

Accepted Answer

It fingerprints your public-facing infrastructure: web server type and version, application frameworks, content management systems and their versions, CDN and reverse proxy configurations, and runtime environments. These are then cross-referenced against CVE data. Many teams find their infrastructure components have more open CVEs than their application packages.

Question 10

Can I monitor multiple projects or clients?

Accepted Answer

Yes. Each stack is independently named and monitored. On Starter you get 10 stacks; on Pro, unlimited. A consulting firm or MSSP can set up one stack per client and get isolated alerts for each. The Pro tier also has API access so you can automate stack creation for a large client list.

Question 11

Does Outrightly do penetration testing or active scanning?

Accepted Answer

No. Outrightly is a passive monitoring tool. We never send traffic that could be considered an attack. Domain scanning uses fingerprinting from public HTTP responses and passive sources like Shodan, the same techniques a defender uses to understand their own exposure.

Question 12

Do you support transitive or indirect dependencies?

Accepted Answer

Yes, when you upload a lock file (package-lock.json, poetry.lock, Cargo.lock, Gemfile.lock, etc.) rather than a manifest file, we parse the full resolved dependency tree including transitive packages. We recommend always uploading lock files for full coverage.

Question 13

What is actually on the free tier?

Accepted Answer

The free tier gives you 3 monitored stacks with full CVE matching, access to the public CVE feed (500,000+ entries) with search and filters, CVE detail pages with CVSS scores and KEV status, and a 14-day trial of Starter features. No alerting on the free tier; you check the dashboard manually.

Question 14

Do you offer a free trial of paid features?

Accepted Answer

Yes. Every new account gets a 14-day trial with no card required, 5 stacks, 50 packages per stack, and domain scanning. Email alerts, Slack, and full Starter/Pro features require a paid plan. After 14 days the account drops back to Free tier unless you upgrade.

Question 15

Is there an annual plan?

Accepted Answer

Yes. Annual billing gives roughly 20% off: Starter drops from $19/month to about $15/month billed annually, and Pro drops from $49/month to about $39/month. You can switch between monthly and annual on the billing portal at any time.

Question 16

Can I cancel anytime?

Accepted Answer

Cancel anytime from the billing portal with no cancellation fee. When you cancel, your plan reverts to free tier. Your stacks, packages, and alert history are retained. We do not delete your data on cancellation.

Question 17

Do you have enterprise pricing or custom contracts?

Accepted Answer

Yes. If you need SSO, custom data retention SLAs, dedicated support, or volume pricing, email us at team@outrightly.io and we will put together a custom arrangement.

Question 18

How do I justify this cost internally?

Accepted Answer

IBM's 2024 security report puts the average data breach cost at $4.88 million. The average time-to-detect for a breach starting with a known vulnerability is 197 days. Outrightly eliminates the "known vulnerability, no awareness" gap. Even a 0.001% reduction in breach probability justifies $588/year (Pro plan).

Question 19

How do I know Outrightly itself is secure?

Accepted Answer

We do not store your source code, only package names and versions. We publish our uptime and incident history publicly. Our infrastructure runs on Vercel and Railway with encrypted secrets at rest and TLS in transit. There is no agent running in your infrastructure.

Question 20

What data do you store about my stack?

Accepted Answer

Package ecosystem (npm, pypi, etc.), package name, and version. That is it. No source code, no build artifacts, no environment variables, no runtime data.

Question 21

What is your uptime SLA?

Accepted Answer

We have maintained 99.97% uptime over the last 90 days, published publicly on our status page. For critical CISA KEV alerts, we have redundant polling so a single infrastructure hiccup does not cause missed alerts.

Question 22

Are you SOC 2 compliant?

Accepted Answer

We are currently working toward SOC 2 Type I. We can share our security posture documentation, infrastructure architecture, and data handling policies with enterprise customers under NDA.

Question 23

Do you sell our dependency data to third parties?

Accepted Answer

No. Full stop. We do not sell, share, or aggregate customer stack data for any commercial purpose. Your package list is yours.

Question 24

Does this require installing an agent on our servers?

Accepted Answer

No. Nothing to install, no agent, no infrastructure change. You connect your stack through the web UI via file upload, GitHub OAuth, or domain entry, and that is it. The monitoring runs on our side entirely.

Question 25

How does GitHub integration work?

Accepted Answer

We use GitHub OAuth with read-only access to your repositories, specifically to read dependency files. We do not read source code beyond those files, do not write anything back, and do not access secrets. You select which repo to connect and we re-read dependency files on a daily sync.

Question 26

Can I use the API to automate stack management?

Accepted Answer

Yes, the API is available on the Pro tier ($49/mo). You can create and update stacks programmatically, add packages in bulk, query CVE matches, and retrieve alert history. Full documentation is at docs.outrightly.io/api.

Question 27

How do Slack alerts look?

Accepted Answer

Slack alerts use Block Kit formatted messages. Each alert includes the CVE ID, severity badge, affected package and version, CVSS score, a one-sentence description, KEV status if applicable, and a link to the full CVE detail page. You control minimum severity threshold in notification preferences.

Question 28

Can I connect it to PagerDuty, Jira, or my ticketing system?

Accepted Answer

On the Pro tier, you get webhook support: a JSON payload fires to any URL you specify when a match is found. Most teams connect this to a Zapier or Make.com automation that creates a Jira ticket, fires a PagerDuty alert, or routes to whatever system your team already uses.

Question 29

Do you integrate with CI/CD pipelines?

Accepted Answer

Yes. Generate an API token from your dashboard and use it to query your stack's open Critical or High CVEs from any pipeline step. A native GitHub Actions step (outrightly/scan-action) is available to fail a build when unmitigated vulnerabilities are detected. GitLab CI and Bitbucket Pipelines work via the REST API.

Question 30

What is AI Security Analysis and how does it work?

Accepted Answer

On any CVE detail page, clicking "AI Security Analysis" expands a three-section panel with a plain-English Description, Impact, and Mitigation specific to that vulnerability. The content is generated by Claude using the actual NVD description, affected component names, and function-level details from the advisory, not a generic template. Results are cached per CVE for instant load on repeat visits. As with any AI-generated content, verify ecosystem-specific remediation steps (e.g. package version numbers) before applying them to production systems.

Question 31

How does the Remediation Workflow feature work?

Accepted Answer

When a CVE alert fires for your stack, you can open a remediation record and move it through five stages: Open → Investigating → Patching → Testing → Mitigated. Each stage transition is timestamped and can include notes. Your whole team sees the current status, so nothing falls through the cracks between the alert and the fix landing in production.

Question 32

What are Team Workspaces?

Accepted Answer

Team Workspaces let you invite colleagues to your Outrightly account and share stacks across the team. Each member gets a role, Admin, Member, or Viewer, controlling what they can create, edit, or only read. Remediation records, alert history, and stack configuration are all visible to the team, replacing the "one person has the alerts" anti-pattern.

Question 33

How is this different from Snyk?

Accepted Answer

Snyk is primarily a code-scanning tool that runs in CI and finds vulnerabilities at build time. Outrightly is a continuous monitoring tool that watches your live production stack and alerts when a new CVE is published post-deployment. These are complementary. Also, Snyk charges per developer; a 10-person team on Snyk Business pays around $980/month. Outrightly Pro is $49/month for the whole team.

Question 34

What about GitHub Dependabot?

Accepted Answer

Dependabot automatically opens PRs to bump vulnerable dependencies; it is a patch automation tool. It is GitHub-only, scans only code repositories, has no infrastructure awareness, and does not alert in real-time on CISA KEV additions. Outrightly adds the real-time alerting layer and infrastructure coverage that Dependabot lacks. They are complementary.

Question 35

Why not just use the NVD RSS feed?

Accepted Answer

The NVD RSS is around 400 items per day, completely unfiltered. You would get alerts about vulnerabilities in IBM mainframe software, SCADA systems, and Windows kernel drivers. The work is the filtering and the matching: knowing which of those 400 daily CVEs is relevant to your production system. That is what we do.

Question 36

Where is my data stored?

Accepted Answer

Our database runs on PostgreSQL hosted on Railway with US-East region by default. Application layer runs on Vercel edge network. If your compliance requirements mandate data residency in a specific region, contact us.

Question 37

Are you GDPR compliant?

Accepted Answer

Yes. We store only what we need to provide the service. You can request deletion of your account and associated data at any time, processed within 30 days. We have a Data Processing Agreement available for enterprise customers.

Question 38

Can I export my data?

Accepted Answer

Yes. You can export your stack definitions, package lists, and alert history at any time from the dashboard. We want you to own your data and be able to leave if you want to.

Question 39

How long does setup take?

Accepted Answer

Under 5 minutes to get your first stack monitored. Create an account, name a stack, and either upload a dependency file or enter your domain. We parse it, cross-reference against CVE databases, and show you any matches immediately.

Question 40

What if I do not get any alerts? Does that mean I am safe?

Accepted Answer

It means there are no currently published CVEs in our databases that match your specific package versions. That is genuinely good news. It does not mean new CVEs will not appear tomorrow, and that is exactly why continuous monitoring matters rather than a one-time scan.

Question 41

I got an alert. What do I do with it?

Accepted Answer

Each alert links to a CVE detail page showing the full description, CVSS score breakdown, affected version range, and recommended remediation, typically the version to upgrade to. We surface the information; your team decides priority and timeline for patching.

Question 42

What if I need help setting it up?

Accepted Answer

Email team@outrightly.io; we respond the same day. For new Pro customers, we offer a 20-minute onboarding call to walk through your stack configuration and make sure alerting is set up correctly.

Answers to every question
we get asked

Still have questions?

Answers to every questionwe get asked

Still have questions?

Answers to every question
we get asked