Three capabilities that close the loop from CVE alert to confirmed fix: CVE-specific AI breakdowns on every detail page, a 5-stage remediation pipeline, and team workspaces with role-based access. Plus a native GitHub Actions step for CI/CD gating.
Today we are shipping four features that close the gap between "we got an alert" and "we confirmed the fix is in production." AI Security Analysis puts a CVE-specific plain-English breakdown on every detail page. Remediation Workflow tracks each fix through five explicit stages. Team Workspaces gives your whole team shared visibility. And a native GitHub Actions step lets you gate deployments on open CVEs. Here is what each one does and why we built it.
Every CVE detail page now has an AI Security Analysis panel. Click it and you get three sections: Description, Impact, and Mitigation. written specifically for that vulnerability.
The key word is specifically. Most AI-generated security content recycles CVSS metadata into template sentences: "This vulnerability allows attackers to execute arbitrary code. Update to the latest version." That tells you nothing you didn't already know from the severity badge.
Our analysis is generated by Claude using the actual NVD advisory text. It extracts the affected component name, the specific functions or code paths involved, the conditions that trigger the vulnerability, and the concrete consequences of exploitation. The mitigation section includes the exact version to upgrade to and the upgrade command where available.
Results are cached per CVE. The first request generates and stores the analysis; subsequent visits load instantly. When no API key is configured, a fallback extracts the same structural information directly from the NVD description text. still specific to that CVE, not a generic template.
An alert that lands in your dashboard and gets acknowledged is not a closed vulnerability. Between "we know about it" and "it is patched in production" there is a process, and that process was previously invisible to Outrightly.
Remediation Workflow makes it visible. Open a record from any alert and move it through five stages:
Each stage transition is timestamped automatically. You can add notes at any stage: the PR number, the engineer who owns it, a reason for deferral, anything relevant. Your whole team can see the current status of every open remediation.
The goal is to make the gap between detection and closure measurable. If a Critical CVE has been in the Investigating stage for 4 days, that should be visible to more than one person.
The most common way teams use Outrightly today is one account, one person with the password, and everyone else asking that person for status updates. That works until it doesn't.
Team Workspaces lets you invite colleagues and share your stacks, alerts, and remediation records with the whole team. Three roles control what each person can do:
Invites go out by email from Settings → Team. The invitee clicks a link, creates an account or signs in, and lands directly in your workspace.
Team Workspaces are available on the Pro plan.
The API has always made this possible. Today we are making it easy with a native GitHub Actions step.
Add outrightly/scan-action@v1 to any workflow, pass your API token and stack ID, and the step will fail the build if your stack has unmitigated Critical or High CVEs. The severity threshold is configurable. A summary of matched CVEs is posted as a PR comment.
For teams not on GitHub Actions, the existing REST API endpoint /v1/alerts?severity=HIGH&status=unread returns the same data. Any CI system that can run a curl command and check an exit code can implement the same gate.
The token lives in your CI secrets. Nothing runs in your infrastructure. No agent, no sidecar, no network policy changes required.
These four features complete what we think of as the detection-to-remediation loop: you know about the CVE (alerts), you understand it (AI analysis), you track the fix (remediation workflow), your team sees it (workspaces), and your pipeline catches regressions (CI/CD gating).
The next area we are working on is reporting: exportable evidence of your security posture over time, suitable for compliance audits, board updates, and customer security questionnaires. If that is something your team needs, email us at team@outrightly.io. we are actively shaping the feature based on what real teams need from it.
Takeaway
All four features are live now. AI Security Analysis is on every CVE detail page with no configuration required. Remediation Workflow and Team Workspaces are available on the Pro plan. The GitHub Actions step is open-source at github.com/outrightly/scan-action. As always, if something is broken or something is missing, email team@outrightly.io. we read every message.