SAST reachability verdicts

Every SAST finding on a scanned repo gets a reachability verdict from the entry-point call-graph gate (and, for Go and C#, a taint pass). The verdict ANNOTATES the finding - the RED/YELLOW/GREEN engine tier never changes.

The verdicts

Verdict	Meaning	De-escalates?
Reachable	The finding’s function is reachable from an entry point.	No
Reachable + tainted	Reachable AND user-controlled data flows into the flagged call.	No
Reachable - not tainted	Reachable, but no tainted data flow reaches it.	Yes
Not reachable	Not reachable from any entry point.	Yes
Unknown	Analysis could not run (unsupported language, tooling missing, or an analysis failure). Fail-open: never hidden, never de-escalated.	No
Not applicable	Reachability cannot apply to this finding type - see below.	No

Not applicable - and why

Some findings have no code path to analyze. They keep full engine severity and read Not applicable with the reason:

• License finding - a dependency licence flag on a manifest or lockfile.
• Container finding - a Dockerfile or infrastructure misconfiguration.
• Config finding - a rule hit on a configuration file no code analyzer owns.

Secrets are special

Secret findings never get a reachability verdict at all: a leaked credential is exploitable by existing in the repo, not via a call path. Because reachability never de-escalates a secret, a false positive needs an explicit exit - the dashboard Ignore button on the finding’s card, a permanent fingerprint-keyed suppression that survives re-scans, with an Ignored filter bucket and Un-ignore to reverse it. See Secret detection for the Ignore action, the Ignored bucket, and when to prefer it over a repo-side // alertavuln-ignore comment; and Secret detection for the full policy, including which files local scans consider.

The conservative posture

• A verdict the analysis cannot PROVE stays at the flagged tier - unprovable-clean is never de-escalated.
• Any analysis failure reads Unknown (fail-open).
• Extra entry points (job runners, plugin hosts) can be declared in .av/reach-sast.json:

{ "extraEntryPoints": ["pkg.Func", "Namespace.Type.Method"] }

Language support

Go, C#, PHP, Python, JavaScript/TypeScript, and Java. When you run the gate via the CLI, C# and Java need their sidecar analyzers next to the av binary - AV-hosted scanning has them built in.