> For the complete documentation index, see [llms.txt](https://docs.veedna.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veedna.com/continuous-vulnerability-elimination-factory-cvef.md). # Continuous Vulnerability Elimination Factory (CVEF) ## What Is CVEF? CVEF automates end-to-end vulnerability remediation across your projects. It runs four stages: Scan, Fix, Verify, and Deliver. This pipeline turns projects with open vulnerabilities into verified, deployable fixes. Live Lineaje platform data tracks each stage in real time. | **Stage** | **What happens** | | --------- | --------------------------------------------------------------------------------- | | Scan | SBOM360 scans the project and reports open vulnerabilities. | | Fix | CVEF applies an automatic fix, or queues one for your approval. | | Verify | CVEF confirms the fix resolves the vulnerability without introducing regressions. | | Deliver | CVEF raises a pull request (PR) in your repository for you to merge. | A project reaches **Delivered** when each vulnerability completes Fix and Verify. Its pull request must also merge. With CVEF, you can: * **Manage Everything From Mission Control:** Track elimination progress, pipeline stages, and project and component health in one dashboard. * **Track Every Project:** View connected projects by risk and asset type. Open each project's scan history. * **Follow Every Vulnerability:** Track vulnerabilities through Active, In Active Fix, Awaiting Verification, and Resolved. Filter by severity or fix state. * **Review AI Fix Plans for Components:** View the recommended version, estimated effort, and plan type for vulnerable components. * **Run the Factory With Tasks and Escalations:** Lineaje Forward Deployed Engineers (FDEs) monitor remediation tasks. They identify blocked work and act on service-level agreement (SLA) breaches and open pull requests. ## How CVEF, SBOM360, and Scanner Hub Work Together **SBOM360** connects repositories and container registries. It also configures the scanners that inspect them, including the Frontier Model Scanner. **CVEF** uses SBOM360 scan results for the Fix, Verify, and Deliver stages. Use the product selector at the navigation bar's upper left to switch products. Both products use Scanner Hub to configure and manage Lineaje-native and third-party scanners. Scanner Hub supports open-source packages, private source code, registries, artifacts, binaries, and SBOMs. In SBOM360, access Scanner Hub from the main navigation. In CVEF, Scanner Hub appears under **Supervisor** for Lineaje FDEs only. FDEs can configure scanners for customers. **Frontier Model Scanner** is an opt-in scanner that uses a large language model (LLM) to detect novel vulnerabilities. These issues are not yet catalogued in public databases. The scanner identifies novel Common Weakness Enumeration (CWE) class risks, validates exploitability in a dynamic sandbox, generates a fix, and opens a pull request. Lineaje assigns each novel vulnerability a unique identifier prefixed with `LVE`. Configure both scanners. The OSS Scanner is included with standard SBOM360 coverage. The Frontier Model Scanner detects novel vulnerabilities the OSS Scanner cannot detect. It scans your first-party and open-source code. Your LLM provider bills usage per scan. Your organization supplies its API key and pays these costs directly. Lineaje does not proxy or subsidize LLM usage. ## How Vulnerabilities Get Fixed CVEF routes each vulnerability through one of three remediation paths. The path depends on vulnerability type and fix availability. | **Vulnerability type** | **Fix path** | **Approval required?** | | ----------------------------------------------------------------- | --------------------------------------------------------- | ---------------------- | | OSS vulnerability (CVE) with a Gold OSS alternative available | Auto-fix runs as soon as the scan completes | No | | OSS vulnerability (CVE) with no Gold OSS alternative available | Lineaje rebuilds the component, or prepares a premium fix | Yes | | Novel vulnerability (LVE), detected by the Frontier Model Scanner | AI-generated fix, queued for review | Yes | Novel vulnerabilities are never fixed automatically. CVEF requires approval before making changes. Premium fixes and rebuilds also require approval. Lineaje charges for this remediation work. Each component fix plan uses one of three plan types: | **Plan type** | **Meaning** | | ------------- | ------------------------------------------------------------------------ | | Rebuild | Lineaje rebuilds the component with the vulnerability removed. | | Curated | A curated Gold OSS alternative replaces the vulnerable component. | | Premium | A Lineaje-prepared premium fix. Approval is required before application. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.veedna.com/continuous-vulnerability-elimination-factory-cvef.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.