> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cybedefend.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Exploitable Path

> Identify whether vulnerable dependencies are actually used in your code with SCA reachability analysis

## Overview

The **Exploitable Path** feature (also known as **Reachability Analysis**) determines whether vulnerable SCA dependencies are actually imported and used in your codebase. Instead of treating every dependency vulnerability equally, CybeDefend pinpoints the ones that matter — the packages your code actually calls — so you can focus remediation where it counts.

<CardGroup cols={2}>
  <Card title="Reachability Detection" icon="route">
    Automatically identifies whether each dependency is used, unused, or potentially used in your code
  </Card>

  <Card title="Priority Adjustment" icon="arrow-up-right-dots">
    Boosts priority for used packages and lowers it for unused ones, so critical risks surface first
  </Card>

  <Card title="Auto-Ignore Unused" icon="eye-slash">
    Optionally auto-ignores vulnerabilities in dependencies your code never imports
  </Card>

  <Card title="Import Locations" icon="map-pin">
    Shows exactly where in your code each dependency is imported, with file paths and line numbers
  </Card>
</CardGroup>

***

## How It Works

During an SCA scan, CybeDefend analyzes your source code to detect import statements and matches them against detected dependencies. Each package receives a **reachability status**:

| Status               | Meaning                                                           | Impact                                                     |
| -------------------- | ----------------------------------------------------------------- | ---------------------------------------------------------- |
| **Used**             | The package is directly imported in your code                     | Priority is **promoted** one level (e.g., normal → urgent) |
| **Unused**           | No import of this package was found in your code                  | Priority is set to **very low**; optionally auto-ignored   |
| **Potentially Used** | The package may be used indirectly (e.g., via a framework plugin) | No automatic priority change                               |

<Info>
  For **transitive dependencies** (indirect dependencies pulled in by your direct dependencies), CybeDefend traces the dependency chain and propagates import locations from ancestor packages when available.
</Info>

***

## Import Location Tracking

When a package is marked as **Used**, CybeDefend records the exact locations where it is imported in your code. For each import, you can see:

* **File path** — the relative path to the source file (e.g., `src/utils/helpers.ts`)
* **Line number** — the exact line where the import occurs
* **Code snippet** — the actual import statement content

This allows developers to quickly navigate to the relevant code and assess the actual exposure to the vulnerability.

***

## Priority Adjustment

When reachability priority adjustment is enabled, CybeDefend automatically modifies vulnerability priorities based on package usage:

| Original Priority | Used Package    | Unused Package |
| ----------------- | --------------- | -------------- |
| Very Low          | Low             | Very Low       |
| Low               | Normal          | Very Low       |
| Normal            | Urgent          | Very Low       |
| Urgent            | Critical Urgent | Very Low       |
| Critical Urgent   | Critical Urgent | Very Low       |

<Tip>
  This means a **Normal** severity vulnerability in a package your code actually imports gets promoted to **Urgent**, while the same vulnerability in an unused dependency drops to **Very Low** — dramatically reducing noise in your vulnerability backlog.
</Tip>

***

## Configuration

Exploitable Path analysis is controlled by two per-project settings, both **enabled by default**:

### Reachability Priority Adjustment

When enabled, vulnerability priorities are automatically adjusted based on whether the affected package is used or unused in your code (see the priority table above).

### Reachability Auto-Ignore

When enabled, vulnerabilities associated with **unused** packages are automatically set to **Ignored** status. This significantly reduces noise by hiding vulnerabilities that cannot be exploited since the dependency is never called.

<Steps>
  <Step title="Navigate to Project Settings">
    Open your project and go to the **Settings** section.
  </Step>

  <Step title="Find SCA Reachability Settings">
    Locate the **Reachability Priority Adjustment** and **Reachability Auto-Ignore** toggles.
  </Step>

  <Step title="Toggle as Needed">
    Enable or disable each setting independently based on your team's workflow.
  </Step>
</Steps>

<Warning>
  Disabling reachability auto-ignore will stop automatically ignoring vulnerabilities in unused packages for **future scans**. Previously ignored vulnerabilities will not be automatically restored.
</Warning>

***

## Supported Ecosystems

Exploitable path analysis is available for all package ecosystems supported by CybeDefend's SCA scanner, including:

* **npm** (JavaScript/TypeScript)
* **pip / Poetry** (Python)
* **Maven / Gradle** (Java, Kotlin, Scala)
* **Go modules**
* **NuGet** (.NET)
* **Composer** (PHP)
* **Cargo** (Rust)
* **CocoaPods / Swift PM** (iOS)
* **Pub** (Dart/Flutter)
* **Hex** (Elixir/Erlang)
* **Clojars** (Clojure)
* **Conan** (C/C++)

<Info>
  The accuracy of reachability detection varies by ecosystem. Ecosystems with explicit import statements (e.g., JavaScript `import`, Python `import`) provide the most precise results.
</Info>

***

## Best Practices

<AccordionGroup>
  <Accordion title="Keep Both Settings Enabled">
    The default configuration (priority adjustment + auto-ignore) provides the best signal-to-noise ratio. Only disable these settings if your compliance requirements mandate reviewing all dependency vulnerabilities regardless of usage.
  </Accordion>

  <Accordion title="Review Potentially Used Packages">
    Packages marked as **Potentially Used** may still represent real risk. Review these manually, especially for critical and high severity vulnerabilities.
  </Accordion>

  <Accordion title="Combine with Policy Management">
    Use the [Policy Management](/latest/plateform-overview/key-features/policy-management) feature to create rules that account for reachability. For example, block builds only when a **used** package has a critical vulnerability.
  </Accordion>

  <Accordion title="Check Import Locations for Context">
    When triaging a vulnerability, review the import locations to understand how the package is used. A package imported only in test files may carry less risk than one used in production code paths.
  </Accordion>
</AccordionGroup>

***

**Related:** [License Compliance](/latest/plateform-overview/key-features/license-compliance) · [Managing Vulnerabilities](/latest/managing-vulnerabilities/project-vulnerability-list) · [Policy Management](/latest/plateform-overview/key-features/policy-management)