Reachability VEX Coverage
Findings proven UNREACHABLE by binary analysis should carry VEX status
NOT_AFFECTED. This is how much of that triage is
outstanding, by project version.
{% if floor %}Scoped to severity {{ floor }} and above.{% endif %}
{# The headline. This is the number an operator is here for: how much noise
a single --autotriage run would remove. It counts UNTRIAGED gaps that also
carry the platform ids the VEX API needs — not the raw gap count, which
would promise closures the apply step skips. #}
{% if ran_anywhere %}
{{ "{:,}".format(auto_total) }}
finding{{ "" if auto_total == 1 else "s" }} could be auto-resolved
Unreachable, still untriaged, and appliable — closing them with
--autotriage --autotriage-status NOT_AFFECTED marks each
NOT_AFFECTED / CODE_NOT_REACHABLE.
{% if floor %}Counted at severity {{ floor }} and above only.{% endif %}
{% if auto_total %}
{% for tier, cls in [('critical','critical'), ('high','high'), ('medium','medium'), ('low','low')] %}
{% set n = auto_sev.get('sev_' ~ tier, 0) %}
{% if n %}{{ n }} {{ tier }}{% endif %}
{% endfor %}
{% if auto_sev.get('sev_other', 0) %}{{ auto_sev.get('sev_other') }} none/info{% endif %}
{% endif %}
{% if cov.get('needs_review_total', 0) %}
A further {{ cov.get('needs_review_total') }} unreachable
finding{{ "" if cov.get('needs_review_total') == 1 else "s" }} need a person,
not automation, and {{ "is" if cov.get('needs_review_total') == 1 else "are" }}
not in the number above.
{{ cov.get('needs_review_status_conflict', 0) }} already carry a status
someone chose — those need a decision, or
--vex-override.
{{ cov.get('needs_review_missing_ids', 0) }} lack the platform ids the VEX
API needs — those need the id recovered, which no override will do.
A gap with both problems is counted under each, so the two need not sum.
{% endif %}
{% endif %}
{% if not ran_anywhere %}
Reachability analysis has not run in this scope
No finding here carries a reachability score, so VEX coverage cannot be
measured. A gap count of zero means unknown, not clean —
run a reachability (VULNERABILITY_ANALYSIS) scan before
reading anything below as coverage.
{% endif %}
{% for note in rvc_notes %}
{{ note }}
{% endfor %}
{{ fs.kpi_cell(
("VEX Coverage" ~ (" (" ~ floor ~ "+)" if floor else "")),
(("%.1f" | format(coverage_pct)) ~ "%") if coverage_pct is not none else "—",
dot=("critical" if (coverage_pct is not none and coverage_pct < 50)
else ("high" if (coverage_pct is not none and coverage_pct < 100) else None)),
) }}
{# An em dash, not 0, when reachability never ran anywhere. "0" in this cell
reads as "nothing to close"; the truth is "not measured", which the hero
band and the alert both say — but a reader scanning only the KPI row would
take the zero at face value. The same reason coverage_pct prints an em dash
rather than 0%. #}
{{ fs.kpi_cell(
"Auto-Resolvable",
auto_total if ran_anywhere else "—",
dot=("high" if (ran_anywhere and auto_total > 0) else None),
) }}
{# Every measured figure reads n/a when reachability never ran. A 0 here is
indistinguishable from a measured "nothing to do", which is precisely the
null-vs-zero conflation this report exists to prevent — it would be odd to
preserve that distinction in the data and then discard it in the KPI row. #}
{{ fs.kpi_cell("Needs Review",
cov.get('needs_review_total', 0) if ran_anywhere else "—",
dot=("critical" if (ran_anywhere and cov.get('needs_review_total', 0) > 0) else None)) }}
{{ fs.kpi_cell("Unreachable Findings",
cov.get('unreachable_findings', 0) if ran_anywhere else "—") }}
{{ fs.kpi_cell("Already NOT_AFFECTED",
cov.get('unreachable_not_affected', 0) if ran_anywhere else "—") }}
{{ fs.kpi_cell(
"Versions Without Reachability",
cov.get('versions_without_reachability', 0),
dot=("high" if cov.get('versions_without_reachability', 0) > 0 else None),
) }}
Coverage is the share of UNREACHABLE findings carrying NOT_AFFECTED,
counted only across the {{ cov.get('versions_with_reachability', 0) }} version(s)
where reachability analysis actually ran. Reachability status is inferred from the
finding data itself, not from scan history.
{% if coverage_pct is none %}There is no coverage denominator in this scope.{% endif %}
{% include "_columns_schema.html" %}
{# Fragment rendering (compound / workflow output) strips the chart
{% if render_mode != 'fragment' %}
{% include '_action_buttons.html' %}
{% endif %}