How far do you take reachability on dependency findings before opening a ticket?

Talking SCA here, not SAST, since a SAST finding already points at a line. with dependencies there's a big gap between this package has a CVE and our code calls the vulnerable function through this path. closing that gap by hand across a couple hundred repos eats most of our week. we have started letting an agent read the repo and trace whether... Weiterlesen: How far do you take reachability on dependency findings before openin…