> ## Documentation Index
> Fetch the complete documentation index at: https://docs.d0pam1ne.blackhatethicalhacking.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fix-first priority

> One score from 0 to 100 that says what to fix first: severity blended with exposure, attack paths, known exploitation, CVSS and confirmation.

Severity alone does not tell you what to fix first. A critical issue buried on an internal box nobody can reach can matter less this week than a high-severity issue that faces the internet, sits on one of the engagement's own attack paths and has a CVE already being exploited in the wild. D0pam1ne turns all of that into one **fix-first score** per open issue, from 0 to 100, with the short reasons behind it.

![Top priorities on the Command Center with fix-first scores, risk, project and reasons](https://mintcdn.com/black-hat-ethical-hacking/RzW7SFxpEWfiBeNL/images/insights/command-center-fix-first.webp?fit=max\&auto=format\&n=RzW7SFxpEWfiBeNL\&q=85\&s=f99aeecadeac4a7cfcc774fc37df0e95)

Top priorities on the Command Center: the highest fix-first scores across every client, each with its project and reasons

## How the score is built

The score starts from the issue's severity and adds points for each thing that makes it more urgent. It is capped at 100.

| Signal | Points | Shown as |
| - | - | - |
| Severity: critical, high, medium, low | 55, 40, 22, 8 | `Critical severity` (and so on) |
| Reachable from the internet (an external issue) | +15 | `internet-facing` |
| A CVE on CISA's Known Exploited Vulnerabilities list | +20 | `on CISA's Known Exploited list` |
| Sits on one of the project's [attack paths](https://docs.d0pam1ne.blackhatethicalhacking.com/data/attack-paths.md) | +18 | `on an attack path to a database` (names what the path reaches) |
| CVSS above 7.0 | up to +6 | nudges it up within its severity |
| Confirmed by the team (Verified, Ready or Reported) | +6 | `confirmed` |

Informational notes score 0 and stay out of the ranking.

> [!NOTE]
>
> Two examples from the same engagement: a high-severity issue that is internet-facing, on CISA's list, on an attack path and confirmed scores 100. A critical issue on an internal host that is on an attack path and confirmed scores 79. Priority is not severity: the high comes first.

## What the colours mean

| Score | Colour | Meaning |
| - | - | - |
| 75 to 100 | Red | Act now |
| 50 to 74 | Amber | Soon |
| 25 to 49 | Blue | Planned |
| Below 25 | Muted | Low |

## Where you see it

> [card] Project dashboard
>
> A **Top priorities** card lists the project's highest-scoring open issues, each with its score, risk, title and reasons, one click to the issue.

> [card] Issues list
>
> Every open issue carries its score as a small badge before the title (hover it for the reasons). Turn on **Fix first order** above the list to rank every issue by score instead of grouping by severity. The choice is remembered in your browser.

> [card] Command Center
>
> The **Fix first** band brings the highest scores from every client into one ranked list, each row tagged with its project. See [The Command Center](https://docs.d0pam1ne.blackhatethicalhacking.com/concepts/command-center.md).

> [card] Synapse portal
>
> Clients see **Highest risk first** on their dashboard, built only from what they can already see. See [below](#what-clients-see).

## The Known Exploited list

The KEV signal uses CISA's full Known Exploited Vulnerabilities catalogue, kept on your D0pam1ne server and refreshed once a day by the scheduler (the same download that feeds [Vuln Intel](https://docs.d0pam1ne.blackhatethicalhacking.com/vuln-intel/overview.md)). A fresh install fetches it within a minute of starting. Scoring itself never makes a network call: it reads the local copy, so if the server is offline for a day the last copy simply stands.

## What clients see

In the Synapse portal, a client's **Highest risk first** list uses the same score with one difference: the attack-path part is left out. Attack paths are your team's analysis of how an attacker would move through the client's systems, and they are kept out of everything the client sees, the same as the client report. So a client's ranking is built from severity, internet exposure, CISA's list and CVSS, and the reasons never mention attack paths. Only issues already reported to the client and still open are ranked. Their order can differ slightly from your team's for that reason. See [The client portal](https://docs.d0pam1ne.blackhatethicalhacking.com/synapse/portal.md#highest-risk-first).

> [!NOTE]
>
> The score is guidance for ordering the work. It never changes an issue's status, severity or deadline.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.