How to Use the Patch Priority Leaderboard

Beginner 15 minutes Engineering Managers / Security Engineers / Dev Leads Remediation & Patching Updated

Pick the next dependency to upgrade from the Patch this first card — vulnerable packages ranked with KEV-pinned and EPSS≥0.5 ones first, with `+N deps unblocked` badges showing how much of the dependency tree sits below each one.

What the Leaderboard Solves

Most teams pick the next upgrade by going down the CVE list, top-CVSS first. That misses two things:

  1. What is actually being exploited. A CVSS 9.8 in a library nobody targets matters less than a CVSS 7.5 on CISA’s Known Exploited Vulnerabilities (KEV) list, or one with an EPSS score of 0.7.
  2. Transitive blast radius. A package that sits above 14 transitive dependencies is a bigger lever than a leaf with a higher CVSS.

The Patch Priority leaderboard ranks packages by exploitation signal first and CVE count second, and shows how much of the dependency tree sits below each one.

Prerequisites

  • Packages have flowed through the proxy, so the intelligence cache has vulnerability data.
  • A role with findings read access (the leaderboard API is gated on findings:read).

Step 1: Open the Leaderboard

The leaderboard is the Patch this first card on the Overview page (see tutorial 20). It shows the top 10 rows.

There is no separate leaderboard page. For more rows, either:

  • follow the card’s link to Investigate → Findings filtered to known-exploited vulnerabilities (/investigate/findings?kev=true), or
  • call the API with a larger limit (up to 100) — see Step 5.

When no package in your cache is flagged vulnerable, the card says so (“Nothing urgent to upgrade right now”) instead of showing an empty table. Every vulnerable package can appear, not only KEV or EPSS-high ones; those simply rank first.

Step 2: Read the Columns

ColumnMeaning
PackageThe cached package coordinate (name, version and repository) carrying the flagged CVEs
SignalsKEV when at least one CVE is on CISA’s KEV list; EPSS N% when the highest EPSS score is at least 0.5; +N deps unblocked when the dependency graph for this coordinate is known
CVEsNumber of CVEs on the coordinate. Expand the row to list them, each linking to NVD

The +N deps unblocked badge is the size of the coordinate’s transitive closure — the number of dependencies below it. It is an upper bound on what an upgrade could free up, not a count of fixes. It is hidden when the dependency graph has not been materialised, rather than shown as +0.

Step 3: Understand the Ranking

Rows are sorted by a single score, computed on the server so the card, the API and Billy agree:

score = 600 if KEV-pinned
      + 150 if EPSS ≥ 0.5, plus up to 50 more as EPSS approaches 1.0
      + 10 × CVE count

A KEV-pinned package therefore always outranks one that is only EPSS-high, and CVE count breaks ties.

If the card shows a banner saying the list is unfiltered, the leaderboard could not join against your org’s installed inventory and is showing vulnerable packages from the whole intelligence cache. Some rows may be packages you do not run.

Step 4: Act on a Row

Chainsaw ranks the work; it does not open upgrade PRs. From a row:

  1. Expand it and check the CVE list against your own exposure.
  2. Use the card’s Renovate guide link to have your existing PR bot propose the upgrade.
  3. To preview an upgrade before opening a PR, run the patch simulator (API and Billy only; off by default).

Step 5: Query the Leaderboard from the API

The same ranking is available for your own dashboards. limit is the only query parameter (default 25, maximum 100):

curl -H "Authorization: Bearer $CHAINSAW_TOKEN" \
     "https://chain305.com/chainproxy/api/leaderboard/patch-priority?limit=10" \
     | jq '.entries[] | {package, version, repository, kev_pinned, epss_score, cve_count, score}'

The response also carries total (every vulnerable package version ranked, before the limit), limit, and fallback_mode (unfiltered when the inventory join is unavailable, store_unavailable when the server has no database).

Step 6: Schedule a Cadence

The most successful teams don’t browse the leaderboard ad hoc. They:

  • schedule a weekly patch-priority sync (15 minutes, eng leads and security),
  • walk the top rows for the week, assign owners and open tickets,
  • at the next sync, confirm last week’s upgrades landed and walk the new top rows.

To track progress over time, save the API response each week and compare total and the set of package@version rows yourself; the endpoint does not compute deltas.

Verification

  1. The Patch this first card on the Overview page shows rows, or the “Nothing urgent” message when no cached package is KEV-pinned or EPSS-high.
  2. Expanding a row lists its CVEs, each linking to NVD.
  3. GET /api/leaderboard/patch-priority?limit=10 returns the same rows in the same order.