After a free scan shows vulnerable packages, spend your first hour sorting them by fix availability, exposure and exploitation signals, not by severity alone. Upgrade what has an easy fix, mitigate what does not, and write down anything you accept. The goal is a short ordered list, not zero findings.
Minutes 0 to 10: copy the results
The scan tells you which packages carry known vulnerabilities. Copy each package, version and CVE id into a simple list. The page does not describe an export, so do this by hand or with a screenshot.
Minutes 10 to 25: open each CVE
For each id, open the CVE page and note fix status, severity, CVSS and EPSS. FIRST describes CVSS as a measure of severity, not risk, and says the base score should not be used alone. EPSS is a 30 day exploitation probability. Add one more check: is it in CISA's KEV catalog? CISA recommends using KEV as an input to prioritization.
Minutes 25 to 40: sort into four bins
- Fix available and a small upgrade. Do these first.
- Fix available but a major version jump. Schedule with testing.
- No fix yet. Look for mitigation guidance.
- Dev only dependency. Lower urgency, still note it.
Minutes 40 to 50: check exposure
Ask, for each remaining item, three questions. Does the vulnerable package run in production or only in tests? Does it handle untrusted input? Does your code call the affected function? The third needs code review or reachability analysis. A lookup scan cannot answer it.
Minutes 50 to 60: write decisions
For every item, record one of: upgrade (with ticket), mitigate (with owner and date), accept (with reason and review date). Accepting is a legitimate choice when written down.
Common mistakes
Sorting only by the biggest number. A low EPSS high CVSS finding on an internal tool may rank below a medium one on your login path.
Upgrading everything at once. Batch changes make breakage hard to trace.
Forgetting transitive packages. The free scan only checks what you submit.
Keeping it going
A one time scan ages quickly as new advisories arrive. Rerun on a schedule, or use continuous dependency scanning such as Safeguard's. The free scan is at gold.safeguard.sh/scan.
Quick check
Should I fix criticals first?
Usually, but check fix availability, exposure and exploitation signals first. A critical in an unused path can wait behind a lower rated issue on an exposed one.
Sources
Last reviewed: 19 October 2026.
