Skip to content
AlertaVuln DocsAlertaVuln DocsAlertaVuln Docs

Reading and overriding verdicts

Once av reach analyze has run, every matching alert carries a reachability verdict: a badge summarising whether the vulnerability is likely exploitable in your project, an expandable panel with the evidence, and a one-click override.

On the alert

Section titled “On the alert”

Each alert row shows a verdict badge next to its RED / YELLOW / GREEN status:

  • Likely exploitable, Needs review, or Likely not exploitable - the band the EffectivePriority falls into.
  • Known exploited - a distinct treatment when the CVE is on the CISA KEV list.
  • Unanalyzed - no usage report has been uploaded for the project yet.

The verdict annotates the alert; it never changes the alert’s own RED / YELLOW / GREEN tier. When verdicts are present the alert list sorts by EffectivePriority and gains a verdict-band filter.

Expanding the panel shows the three evidence layers - how the package is used (with the file:line import sites), the exploit context (EPSS, KEV, attack vector), and your declared exposure - plus the plain-language reasoning and a priority meter.

Overriding a verdict

Section titled “Overriding a verdict”

When you know better than the machine - the package is only used in a sandboxed build step, say, or a “transitive-only” dependency is in fact called directly - record an override. An override wins over every later recomputation and is kept until you clear it; who set it, when, and why are stored beside the machine verdict.

From the web app, open the alert’s reachability panel and choose Override, mark it Not exploitable or Exploitable, and enter a required reason.

API

Section titled “API”

Overrides are also available over the API and MCP. All three endpoints are project-scoped and require a Business or Enterprise subscription; the override endpoints additionally require a write-enabled key.

List verdicts for a project (optionally one CVE):

Terminal window
curl -H "Authorization: Bearer $ALERTAVULN_API_KEY" \
  "https://alertavuln.com/api/projects/$PROJECT_ID/reachability/verdicts?cve=CVE-2024-0001"

Record an override:

Terminal window
curl -X PUT \
  -H "Authorization: Bearer $ALERTAVULN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"verdict":"NotExploitable","reason":"only used in a sandboxed build step"}' \
  "https://alertavuln.com/api/projects/$PROJECT_ID/reachability/verdicts/$VERDICT_ID/override"

Clear an override (restores the machine verdict):

Terminal window
curl -X DELETE \
  -H "Authorization: Bearer $ALERTAVULN_API_KEY" \
  "https://alertavuln.com/api/projects/$PROJECT_ID/reachability/verdicts/$VERDICT_ID/override"

See also

Section titled “See also”