Documentation
Vellaci docs
Searchable, versioned with the product. Each page reflects the release you are using.
Getting Started
- Your first 15 minutesFrom sign-up to the first vulnerable component.
- Roles and permissionsOwner, admin, security, compliance, engineer, auditor, external advisor.
Products
- Product registryProducts, versions, lifecycle, classification, exposure context.
SBOM
- SBOM ingestionUpload, GitHub, GitLab, CI/CD and the API.
- VEXPer-product exploitability statements and signed CycloneDX VEX documents.
Vulnerabilities
- Intelligence and prioritySources, provenance, EPSS, exploitation evidence, priority model.
- Triage workflowStatuses, reasons, bulk actions, tickets.
Incidents
- Incident handlingRecords, awareness, reportability, tickets, AI summary.
CRA Reporting
- Reporting cases and deadlines24h early warning, 72h notification, final report.
- Runbook and drillsOrganisation readiness and simulated exercises.
Evidence
- Evidence vaultFiles, links, versions, legal hold, retention.
API
- API overviewTokens, scopes, pagination, rate limits, errors.
- CI/CD SBOM ingestionGitHub Actions, GitLab CI, Jenkins, CircleCI examples.
- Outgoing webhooksEvents, signatures, retries.
Integrations
- IntegrationsGitHub, GitLab, Jira, Linear, Slack, Teams, PagerDuty.
Admin
- Security settingsMFA, SSO, approvals, tokens, auditors, retention, deletion.
Security
- Security architectureIsolation, encryption, audit chain, threat model summary.
CLI
- Vellaci CLIauth, products list, sbom upload, vulnerabilities list, incidents create, status.