Xpsd: decide if a CVE is actually reachable in your tree (SARIF / GitHub code scanning)

If you have ever opened a Grype/Trivy report and thought “cool, 200 findings, which ones can actually be hit in this codebase?”, that is basically why we built Xpsd. You feed it a CVE or a scan report. It tries to answer a simpler question: is the vulnerable code reachable here? You get a verdict, some evidence, a call path when it can find one, and SARIF so it shows up in GitHub code scanning next to everything else. It does not shove your whole repo into an LLM. The agent pokes around with tools (search, advisory lookup, pulling a dep when it has to). Works as a GitHub Action, Copilot or your own model. Just hit v1.0. Open source, Apache-2.0: https://github.com/ByteRay-AI/Xpsd submitted by /u/Emergency_Stable_923 [link] [comments]Technical Information Security Content & DiscussionRead More