Reachability analysis: why most of your dependency CVEs don't matter

Run any dependency scanner against a real-world repo and you'll get a wall of CVEs — often hundreds on a mature codebase. Teams learn to skim it, then ignore it, then get paged when one of those hundr