Patchlight 0.1.2 — the free edition now holds 150 items

The free edition now holds 150 inventory items, up from 25 — a cap inherited from an earlier product and well below the size of the estate most people want to point Patchlight at first. Pro stays at 500, Team stays unlimited.

The edition table in the README had drifted from the code in three other rows, and the code was right every time: the free scan interval is every 12 hours and fixed, free alert channels are webhook and syslog, and the offline / air-gapped mirror flags were never gated by tier at all. The table now says what the binary does.

Verification identifiers are now Hexward's own — X-Hexward-Token, _hexward-verify.<domain> and /.well-known/hexward-verify.txt. Nothing already installed breaks: verification accepts either the old or the new name, and the webhook sends both headers, so a receiver written against the old one keeps working with no change at either end. The old names are removed on 1 March 2027.

The licence panel, the footer, and the message you get when a free-edition limit is reached now all point at the product page, and docs/CONCEPTS.md explains what Patchlight is reasoning about — CPE, KEV, EPSS, and why a target that returns no findings is the first thing to check rather than the last.

Verify the download before you run it:

sha256sum -c SHA256SUMS
tar xzf patchlight-free-0.1.2-linux-amd64.tar.gz
./patchlight

Pro ($29/mo) and Team ($99/mo), each with a 14-day free trial: whop.com/nizar-tuanku/patchlight-cve-prioritizer

Free: github.com/nizartuanku/patchlight — this repository is the free edition, Apache-2.0, no time limit.

Patchlight 0.1.1 — targets that returned no findings at all

Why this release exists

Free-text product names were turned into CPEs by lowercasing them, replacing
spaces with underscores, and always saying part a. Measured against the live
NVD API, that is right for most application packages and returns exactly
zero for the rest — and zero is indistinguishable from "you have no
vulnerabilities".

target	0.1.0 CPE	0.1.0	correct
nginx 1.24.0	a:*:nginx	2	2
OpenSSH 9.6	a:*:openssh	19	19
MySQL 8.0.35	a:*:mysql	87	87
Apache HTTP Server 2.4.57	a:*:apache_http_server	0	53
Linux Kernel 6.8	a:*:linux_kernel	0	6,582
Ubuntu Linux 22.04	a:*:ubuntu_linux	0	59
Windows Server 2019	a:*:windows_server_2019	0	5,255
Debian 12	a:*:debian_linux:12	0	294

Three causes, all fixed:

• The part field. NVD indexes an operating system under o. A query that
  says a cannot see it, so every OS target reported a clean bill of health.
  The Linux kernel alone accounts for 6,582 CVEs that were invisible.
• The product token. "Apache HTTP Server" is indexed as product
  http_server; gluing the vendor word into the product finds nothing.
• The version string. Distribution releases carry an explicit minor.
  debian_linux 12 returns 0 and 12.0 returns 294; enterprise_linux 9
  returns 3 and 9.0 returns 595. A bare major on an operating system now gets
  its .0. Applications are untouched — tomcat 9 and tomcat 9.0 both
  return 14.

Resolution runs from a built-in table plus part inference, so it works with no
network — which is what an air-gapped install has.

What was not the cause, despite being the prime suspect: the wildcard vendor.
a:*:http_server returns 53 CVEs against 51 for a:apache:http_server, and
o:*:linux_kernel matches o:linux:linux_kernel exactly at 6,582. The wildcard
never lost a CVE and twice found more, so it stays: a guessed vendor can only
narrow the search.

Findings no longer carry another product's fix version

A CVE that requires two products present at once lists both in one
configuration — CVE-2019-0190 is the real case, an AND of Apache httpd and
OpenSSL. Version evidence was taken from the first vulnerable cpeMatch, so an
OpenSSL owner was told their fix version was an httpd release number. The CVE
was right; the evidence was another product's, which is worse, because the
evidence is what you act on.

Evidence now comes only from a cpeMatch that names your own product. When a
configuration never names it, no version evidence is reported at all — an empty
field is honest, a borrowed one is not.

Honest limit

A name Patchlight has never seen can still resolve to the wrong CPE, and a token
NVD does not use finds nothing. A target with zero findings is the first one to
check — open it and confirm the CPE is the one NVD uses.

Verify this download

sha256sum -c SHA256SUMS
tar xzf patchlight-free-0.1.1-linux-amd64.tar.gz
./patchlight

Upgrading from 0.1.0: re-add any operating-system target, or delete and re-add
anything that has been reporting zero findings. Existing targets keep the CPE
they were stored with.

This repository is the free edition — Apache-2.0, no time limit. Pro and Team are paid licences on Whop: whop.com/nizar-tuanku/patchlight-cve-prioritizer. Nothing on Whop is free, so try it here first.

v0.1.0

Patchlight v0.1.0

Self-hosted CVE prioritizer: match CVEs to your real inventory (product+version, raw CPE, or SBOM import — CycloneDX/SPDX) and rank by CISA KEV + EPSS + CVSS. Air-gapped mode via mirrored feeds.

This is the free edition, built from this repository with an empty license issuer key — it has no license activation. Free-tier limits: 25 inventory items. Pro and Team tiers (higher limits, delivered binaries) are available at whop.com/nizar-tuanku/patchlight-cve-prioritizer.

Install

tar -xzf patchlight-free-0.1.0-linux-amd64.tar.gz
./patchlight

Dashboard: http://127.0.0.1:8425 — single binary, SQLite storage in the working directory, no telemetry, nothing leaves your network.

Or build from source (Go 1.24+, CGO required for the SQLite driver):

go build ./cmd/patchlight

Integrity

Verify the download:

sha256sum -c SHA256SUMS

SHA-256: 06a7a63319829574d5dad040d9aed6d6d197b2fb8470a745063d8aeaa0b1f8ed

Feedback

Run it in a lab first. Bug reports and lab feedback via GitHub Issues are very welcome.