Repository navigation
docs(reachability): reachability is on for everyone, and the sources that report it - #16199
Merged
Merged
Conversation
…that report it Reachability is GA in DefectDojo Pro, so the page no longer describes a beta flag a superuser has to turn on. Add a table of the sources that report reachability (report imports, the Universal Parser, the Snyk, Semgrep and Aqua Supply Chain connectors, Sensei and the Reachability API) with the verdicts each can report, and note that a Sensei verdict carries govulncheck's call path. The Sensei page gains a "Reachability analysis" section: govulncheck runs after every successful default-branch scan in hosted mode, and the Asset menu's Run Reachability Analysis runs it on demand. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
blakeaowens
marked this pull request as ready for review
October 7, 2026 02:37
The automatic run is skipped while one for the repository is still queued or running, and Run Reachability Analysis needs a scanned repository and import rights on the Asset. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Maffooch
approved these changes
Oct 7, 2026
devGregA
approved these changes
Oct 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Reachability documentation for DefectDojo Pro, brought up to date with what ships.
triage_findings/finding_scoring/reachability.md): reachability is generally available, so the page no longer says it is a beta feature a superuser turns on under Feature Flags. A new Sources that report reachability table lists each source (the govulncheck, Snyk Issue API and Sysdig report imports, the Universal Parser, the Snyk, Semgrep and Aqua Supply Chain connectors, Sensei, and the Reachability API at/api/v2/reachability/verdicts/), what DefectDojo reads from it, and which verdicts it can report. A short note explains that a Sensei verdict carries govulncheck's call path, shown under Reachability Call Path.sensei/fixing_findings.md): a new Reachability analysis section. For a Go repository, Sensei runs govulncheck and records a verdict with its call path on the matching Findings of the repository's Asset. In DefectDojo-hosted mode it runs after every successful scan of the default branch (skipped while a reachability run for the repository is still queued or running), and Run Reachability Analysis in the Asset's menu runs it on demand for a scanned repository, to a user who can import scan results into the Asset. It always analyzes the default branch, a repository with nogo.modat its root finishes without verdicts, and runs appear in Scan Activity as Reachability Scan.English pages only: the translated copies are regenerated by the docs translation pipeline.
Test results
Documentation only. Every internal link in the changed lines resolves to an existing page, and the new table has a consistent column count.
Checklist
🤖 Generated with Claude Code