Most "you have a CVE" tickets are lying to you.

Somewhere in your backlog right now is a CVE ticket that's lying to you and I built a workflow that catches it red-handed.

A scanner flags a package. Jira opens a ticket. Everyone panics. But most of the time nobody checks the part that actually matters: does your code ever call the vulnerable bit? I built a triage pipeline that checks for real, with evidence, not vibes. Give it a CVE and it figures out what it's even written in, and proves reachability the right way for that ecosystem. No path to the vulnerable code, no panic. A path? It writes the fix, verifies it, and opens the pull request itself, before you've opened Slack. It's not a toy: it's running today as a bot that triages a real security backlog, unattended. Come watch it decide a CVE's fate live on stage and see the one time its verdict was hilariously wrong.

• "Dependency present" and "vulnerable" are different sentences — in every language. Reachability is the difference between a real fire and a fire drill, whether that's go.mod, package.json, or requirements.txt.

• The recipe, stolen and stitched together: govulncheck → call graph → confidence-scored verdict → verified fix → PR, as one repeatable pipeline instead of five manual steps.

• How to let a bot open a pull request without losing sleep over it.

• The receipts on when it lied: one real case where the bot's verdict was wrong, and the lesson on why proof always beats confidence.