How can we help?
Documentation, FAQs, and direct support for everything from your first scan upload to enterprise compliance reporting.
Private Alpha Support
Alpha technical support is monitored at support@cveriskpilot.com. We respond within one business day, and production-blocking issues are treated as same-day incidents.
Get Help
Support channels
Find answers in our docs, explore the API, or reach out directly. We respond to all emails within one business day.
Documentation
CLI setup, scanner integration, GitHub Actions, compliance frameworks, and POAM generation guides.
Browse Docs →
Developer Portal
Developer guide, API-key triage endpoints, model catalog, webhook reference, and curl examples.
Open Portal →
Email Support
Direct technical support for uploads, scan parsing, API integration, CLI issues, or product questions. Include your org name, environment, and screenshot for faster routing.
support@cveriskpilot.com →
Security Disclosures
Report security vulnerabilities responsibly. We acknowledge all reports within 24 hours and provide remediation timelines.
security@cveriskpilot.com →
Report an Issue
Send enough context so we can reproduce it fast
For alpha support, email support@cveriskpilot.com with the items below. This is the fastest path for upload bugs, auth failures, parser issues, and unexpected product behavior.
Include these details
- Organization name and user email
- Where it happened: the web app, the CLI, or the API
- What you tried to do and the exact error text
- Screenshot plus approximate time and timezone
Knowledge Base
Frequently asked questions
Answers to the most common questions organized by topic.
Getting Started
How do I upload my first scan?
Log in, navigate to the Upload page, and drag-and-drop your scan file. We auto-detect the format from 11 supported scanner outputs (Nessus, SARIF, CycloneDX, Qualys, and more). Findings are enriched with EPSS, KEV, and NVD data automatically.
How do I install the CLI scanner?
No installation needed. Run npx @cveriskpilot/scan in any project directory. It scans for SBOM vulnerabilities, hardcoded secrets, IaC misconfigurations, and maps findings to the shipped framework presets (federal, defense, enterprise, startup, devsecops, healthcare, payments, international, eu-compliance). Run without an API key, the CLI reports the core 6 frameworks; add a CVERiskPilot API key from any plan, Free included, to see all 13.
What scanner formats are supported?
File upload supports 11 formats: Nessus (.nessus), SARIF, CSV, JSON, CycloneDX (SBOM), Qualys, OpenVAS, SPDX (SBOM), OSV, CSAF, and XLSX. The CLI scanner supports 13 package manager lockfile formats.
How do I set up compliance frameworks?
Compliance frameworks are reviewed in the Compliance Hub after you upload findings. The app auto-builds the readiness view from your organization data. Use the CLI presets or API scopes to choose the coverage you want for a scan; you do not manually configure frameworks on the dashboard.
CLI Scanner
Can the CLI scan for hardcoded secrets?
Yes. The secrets scanner detects 30+ credential patterns (AWS keys, Stripe keys, GitHub PATs, database connection strings, private keys, JWTs, and more) plus high-entropy string detection via Shannon entropy analysis. Run with --secrets-only to scan secrets exclusively.
What package managers does the CLI support?
13 formats: npm (package-lock.json), yarn (yarn.lock), pnpm (pnpm-lock.yaml), pip (requirements.txt), Pipfile.lock, poetry.lock, pyproject.toml, Go (go.sum), Cargo (Cargo.lock), gem (Gemfile.lock), Maven (pom.xml), Gradle (gradle.lockfile), and .NET (packages.lock.json).
How do I add the scanner to CI/CD?
Use our GitHub Action or add npx @cveriskpilot/scan --format sarif to any CI pipeline. The GitHub Action posts compliance results as PR comments. See the GitHub Action setup guide in our docs.
Can I scan a specific framework only?
Yes. Use --frameworks nist-800-53,cmmc to limit the scan to specific frameworks. Use --list-frameworks to see all available framework IDs.
API & Integrations
How do I get an API key?
Navigate to Settings > API Keys in your dashboard. Generate a new key, give it a name, and copy the key value. API keys are scoped to your organization and respect your RBAC role permissions.
What scanner connectors are available?
Adapters for Tenable.io, Qualys VMDR, CrowdStrike Falcon Spotlight, Rapid7 InsightVM and Snyk are built, but automatic sync is not running yet. Today, export results from your scanner and upload the file.
Can I push findings to Jira?
Yes. Configure the Jira integration in Settings > Integrations with your Jira instance URL and API token. Cases can be pushed to Jira as issues with compliance context, risk scores, and remediation guidance included.
Is there a webhook for new findings?
Not yet. You can register an endpoint in Settings > Webhooks and send a test delivery signed with HMAC-SHA256; event delivery (finding.created, case.status_changed and others) is planned.
Compliance & Reporting
How does compliance mapping work?
CVERiskPilot uses a CWE-to-control bridge. Each vulnerability's CWE weakness classification is mapped to specific controls across the 13 supported frameworks. For example, a SQL injection finding (CWE-89) maps to NIST 800-53 SI-10 and SA-11, SOC 2 CC6.8 and CC8.1, PCI DSS Req-6.2, and equivalent controls in other frameworks.
Can I generate a POAM?
Yes. Open the POA&M tab under Compliance to build a Plan of Action and Milestones from the selected client's open cases, then export it as CSV, JSON or FedRAMP-format XLSX for auditor handoff. POAMs include remediation timelines, risk ratings, and compliance control references.
How does AI triage work?
AI triage sends the finding with its NVD, EPSS, KEV and compliance context to an external model, then applies a deterministic safety policy (for example, KEV-listed and high-EPSS findings are escalated to urgent action unless there is false-positive or compensating-control evidence). It returns priority, recommended action, confidence and reasoning for an analyst to review.
How are compliance scores calculated?
Scores are computed per framework based on the ratio of compliant controls to total applicable controls, weighted by finding severity and enrichment data (EPSS exploitability, KEV active exploitation status). Scores update in real-time as findings are triaged and remediated.
Billing & Account
How does pricing work now?
CVERiskPilot is sold as four compliance packages: Starter (free), Audit Readiness ($149/month, 14-day trial) for SOC 2, HIPAA, PCI DSS, ISO 27001 and NIST CSF 2.0, Federal Assessment (scoped) for CMMC Level 2 and FedRAMP-style POAMs, and Partner for MSSPs. See pricing.
How do I upgrade to Audit Readiness?
Start from /pricing or choose Audit Readiness during signup. Existing Starter workspaces can upgrade from Settings > Billing (where it appears as the Pro plan), which opens the Stripe checkout flow for the workspace owner.
What are the pricing paths?
Starter and Audit Readiness are self-serve: Starter is the easiest way to get started with hosted triage on real scan data, and Audit Readiness is the main paid path. Federal Assessment and Partner are scoped with our team — request a Federal Assessment from /contact or apply at /partners.
What happens if I stay on Starter?
Your Starter workspace remains active with the Starter limits in place. You keep your workspace, uploads, and local CLI usage, and you can upgrade to Audit Readiness later when you need more hosted triage capacity.
Security & Privacy
Where is my data stored?
All data is stored on Google Cloud Platform (GCP) in the US region. Database on Cloud SQL PostgreSQL with automated backups. File storage on GCS. Data is encrypted at rest by Google Cloud, integration secrets are additionally encrypted with AES-256-GCM, and all traffic uses HTTPS with HSTS.
Do you have a SOC 2 report?
Not yet. We have not started a SOC 2 audit; we track our own readiness and will publish a timeline once an auditor is engaged. Our free SOC 2 Readiness Report tool can help you assess your own posture, and our Trust Center at /trust describes our current security architecture.
Is my scan data shared with anyone?
Only with the subprocessors that run the service. Your data is not used to train AI models and is never visible to other tenants: org-scoped tenant isolation is enforced on every query. AI features send finding context to the model providers listed under Subprocessors on /security; triage and remediation prompts are redacted first, while AI chat, query and executive-summary requests are not. See our Privacy Policy for full details.
What authentication options are available?
Email/password, Google and GitHub sign-in. MFA is supported via TOTP authenticator apps with backup codes. Enterprise SSO via WorkOS (SAML 2.0 and OIDC) is set up with our team during onboarding.
Resources
Quick links
CLI Scanner Docs
Setup, configuration, and CI/CD integration
GitHub Action
Automated PR compliance checks
Claude Code plugin
SSVC triage and VEX dispositions over MCP
Developer guide
API-key triage endpoints and examples
Live Demo
Full product walkthrough with sample data
SOC 2 Readiness
Free gap analysis tool
Whitepapers
Technical deep-dives and ROI analysis
Pricing
Compare the four compliance packages
Trust Center
Security architecture and compliance posture
Changelog
Release notes and new features
Email response time
Scanner formats supported
Compliance frameworks
CLI package manager formats
Still need help?
Reach out directly and we'll get back to you within one business day. For enterprise and government inquiries, contact our sales team.