cra
1 post · all writing
The analysis your supplier already did
Your vendor knows which CVEs in their component are actually reachable. They wrote it down. Then you retyped their conclusion into your own config, where it became a decision you are answerable for. Why consuming a VEX document beats copying it, and what the record looks like when the claim keeps its author.