Is there a way to determine whether the vulnerable part of a package is actually reachable?

[Anarogk]

I'm new to this and very curious about it. I came across Evinse Mode / SaaSBOM and found it fascinating how they achieve this at a lower level. I want to confirm: is there a way to implement a feature that determines whether a specific vulnerable code section within a package is actually reachable in a given repository or project?

[prabhu]

The short answer is yes. The long answer is to find a way to share the knowledge and offer demos. Perhaps will invite you to one of the AboutCode office hour sessions?

[Anarogk]

That sounds great! I’d love to learn more and see a demo in action. Let me know how I can join one of the AboutCode office hour sessions. Looking forward to it.