Security scanning

What is reachability analysis?

Determining whether your code actually calls the vulnerable function inside a flagged dependency.

By Cláudia FernandesUpdated 2026-10-02

Many dependency CVEs are unreachable in practice: the package is installed, but the affected function is never invoked from your code. Reachability analysis builds a call graph to check, and can cut the actionable list substantially.

It is one of the most effective ways to reduce SCA noise, but not a free pass. Static call graphs can miss code reached through reflection, dynamic loading or configuration, a function that is unreachable today can become reachable in the next release, and some compliance regimes expect known vulnerabilities to be patched either way. Language coverage is also usually narrow, so treat an unreachable label as a prioritization signal rather than proof.

What to look for

Which languages support it, since coverage is usually narrow
Whether reachability covers transitive dependencies or only direct ones
Whether unreachable findings are suppressed, or just ranked lower
Whether the call path is shown so you can verify the conclusion

Best 10 code quality, security and code review tools with reachability analysis

Every tool in the directory whose documentation covers this, 7 fully and 3 partially. Full support is shown first. Shown in a random order that changes on every visit, so no tool gets an advantage from its position.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

Code Security Platform

Checkmarx One

Exploitable Path reuses SAST to trace the call path to the vulnerable method; Python, Java, JavaScript, C# only.

Code Quality Platform

Codacy

Affected-functions analysis AI-checks whether vulnerable dependency code is actually used.

PR Review Tool

CodeRabbit

Deep Scan findings carry reachability and exploitability signals with call stacks when available

Code Security Platform

Corgea

Checks import plus whether the vulnerable function is called; direct deps only

Code Quality Platform

DeepSource

Call-graph tracing to the vulnerable function; REACHABLE/UNREACHABLE/UNKNOWN with call-path visualization.

Code Security Platform

Semgrep

Five reachability states plus transitivity for 10 languages; Rust version-comparison only; Dart and Elixir unsupported.

Code Security Platform

Veracode

Vulnerable Methods scan (Level 3) checks whether first-party code calls vulnerable third-party methods

Code Security Platform

Aikido

AI CVE exploitability analysis prioritizes exploitable over theoretical; no call-path reachability claimed

PR Review Tool

Greptile

Repo graph surfaces impacted callers and contracts of changed code; not dependency-vulnerability reachability

Code Security Platform

Snyk

Java and JavaScript only; Early Access via Snyk Preview; limits of 300,000 files / 3GB.

SAST Taint Analysis (Data-Flow)Secrets Detection Secrets Validation SCA Malicious Package Detection

FAQ