Skip to content

0001-reachability-annotates-vulnerabilities-not-findings.md

Latest commit

 

History

History
6 lines (4 loc) · 680 Bytes

0001-reachability-annotates-vulnerabilities-not-findings.md

File metadata and controls

6 lines (4 loc) · 680 Bytes
Raw

ADR-0001: Reachability annotates vulnerabilities, not findings

  • Date: 2026-05-14
  • Status: Accepted

Reachability data lives on sdk.Vulnerability.Reachability rather than on Finding.Reachability because --analyze must be useful without --audit. Matchers populate the OSV-aligned Vulnerability record on the PURL-keyed registry package; the analyzer enriches it in place; the output layer resolves the analyzer's annotation by (Finding.PackageRef, Finding.VulnerabilityID) when emitting SARIF and the JSON Finding projection. This keeps a single source of truth (the registry) and removes the per-manifest sync that the old graph-mutating model required.