Skip to content

Document AI-native SCA reachability filters and usage context #80

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Ibrahimrahhal wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Document AI-native SCA reachability filters and usage context #80

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions sca.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ description: "Dependency Scanning, also known as Software Composition Analysis (
- Detailed vulnerability descriptions and references
- Publication dates and external links
* **Smart Scanning Logic**: Automatically detects when dependency files are present and optimizes scanning performance
* **AI-native SCA Reachability (when enabled)**: For direct dependencies, Corgea can analyze whether vulnerable code paths are actually reachable in your codebase and show usage context to help you prioritize fixes

## Setup Instructions

Expand Down Expand Up @@ -127,6 +128,21 @@ description: "Dependency Scanning, also known as Software Composition Analysis (
4. **Issue Creation**: Creates trackable security issues for each vulnerability found
5. **Reporting**: Generates comprehensive vulnerability reports with actionable remediation guidance

### Reachability & Usage Analysis (AI-native SCA)

When AI-native SCA is enabled, Corgea adds reachability and usage signals for **direct dependencies** to help you focus on issues that are truly exploitable in your codebase.

**Reachability statuses**:
- **Reachable**: A vulnerable code path is reachable from your application code
- **Unreachable**: The dependency is used, but no vulnerable call path is reachable
- **Unused**: The dependency is declared but not referenced in your codebase
- **Analyzing**: Reachability analysis is queued or in progress

**Where to find it**:
- In scan results, use the **Reachability** filter to narrow findings by status
- Use **Dependency depth** to filter **Direct** vs **Transitive** dependencies
- In an SCA issue, the Reachability tab summarizes usage and, when available, shows per-file usage context

### Supported Ecosystems

<Accordion title="View All 25+ Supported Ecosystems">
Expand Down