notes on triage, noise, and what to fix first

Reachability analysis: why most of your dependency CVEs don't matter

Lockfile-based CVE scanning treats every dependency as equally dangerous. It isn't. Here's how reachability analysis tells the difference — and where it still falls short.