Reachability reports use a small vocabulary that can sound like jargon. This glossary defines the terms in plain words, in the order you meet them: the code map, the start and end of a path, the data question, the errors, and the way results are recorded. Keep it open when reading your first report.
The code map
Call graph. A map of which function calls which. Each function is a point. See what is a call graph.
Call edge. One arrow in the call graph, from a caller to a callee.
Static analysis. Reading code without running it.
Dynamic analysis. Observing code while it runs.
Start and end of a path
Entry point. A place where execution can begin, such as a handler or a main function. See entry points.
Vulnerable symbol. The named function, method or class that holds the flaw. Advisory records may or may not list it.
Sink. A spot in code where data does something sensitive, like running a command or writing a file. Vulnerable functions are often sinks.
Call path. A chain of edges from an entry point to the vulnerable symbol.
The data question
Taint. Data that comes from an untrusted source and is tracked as it moves through code.
Attacker controlled. Input an outside party can shape. A path with no attacker controlled input to the sink is weaker evidence of risk.
Reachability asks whether the function can be called. Taint analysis asks whether bad data can arrive. They are different questions, and a tool may answer one or both.
The errors
False positive. A reported problem that is not real, such as a path that cannot happen.
False negative. A real problem the tool missed.
Over approximation. Assuming uncertain calls might happen, which tends toward false positives. See over vs under approximation.
Under approximation. Ignoring uncertain calls, which tends toward false negatives.
Recording results
VEX. Vulnerability Exploitability eXchange, a way to state whether a vulnerability affects a product. OpenVEX statuses are not_affected, affected, fixed and under_investigation.
Justification. The reason attached to a not_affected statement, such as vulnerable_code_not_in_execute_path.
Advisory. A record describing a vulnerability, its affected versions and fixes.
Transitive dependency. A package pulled in by another package rather than chosen directly.
Related signals that are not reachability
CVSS rates severity. EPSS estimates the chance of exploitation within 30 days. KEV lists vulnerabilities exploited in the wild. See which signal comes first.
Quick check
Is a sink always a vulnerability?
No. A sink is just a sensitive operation. It becomes a problem when untrusted data reaches it without safe handling.
Is reachability the same as taint analysis?
No. Reachability checks whether a function can be called. Taint analysis checks whether untrusted data can flow to it.
Safeguard includes reachability analysis in its dependency scanning. Try the free scan to see these terms in a real report.
Sources
Last reviewed: 19 October 2026.
