VULNRELAY / SECURITY RESPONSE DESK
A vulnerability just landed.
Who takes care of it?
VulnRelay connects an advisory to components in your repositories, images and environments. Then it organizes the work: what to do, who owns it, what is blocked and when to check again.
Illustrative workflow · Product in development
A signal becomes
an action plan.
- Advisory receivedA previously inventoried component is affected.
- Scope assessedOne repository affected; deployment still to confirm.
- Action assignedTeam assigned, update proposed.
- Evidence pendingNew digest deployed before closure.
01 / THE CASE, NOT JUST THE ALERT
What happens
after an advisory drops.
Walk through a fictional incident. Every decision retains its source and next action; missing evidence stays visible.
02 / THE EVIDENCE CHAIN
CI sees the change.
Monitoring sees what changes later.
A commit, a built image and a deployment are different facts. VulnRelay aims to connect them, then reevaluates inventories when a new advisory appears.
Node, Go, PHP… discovery identifies files and declared dependencies.
The build fixes a digest and reveals the packages actually included.
This evidence confirms impact and verifies that a fix has arrived.
Even if the repository does not change, a new advisory triggers a fresh match against recorded versions.
If a step is missing, the case says “to confirm”. A green CI run alone does not prove that production is fixed.
03 / DEMONSTRATION CASES
One method.
Different situations.
Choose a fictional service to see the available evidence, next action and limits of what we know.
The five displayed cases are fictional. The closed beta scans the root composer.lock of public GitHub or GitLab.com repositories, with scheduled checks and in-app notifications. Private Git connections, CI, Docker images and external notifications are still to be built.
04 / AUTOMATION WITH CLEAR LIMITS
The assistant prepares.
Evidence decides.
AI may summarize an advisory and prepare a proposal. Assessment, permissions and closure must remain verifiable.
Match versions, deduplicate alerts and follow up on overdue cases.
An action plan, an update or a PR, subject to customer permissions and tests.
Production evidence, a human decision or a hosting provider response; explain why and when to resume.
05 / REQUEST ACCESS
Test VulnRelay
with us.
The beta is closed. Tell us about your setup and goals. We will review your request and reply personally by email. Do not send repository credentials or access tokens.
VULNRELAY / CLOSED BETA