GoKawiilNixOS project highlights VEX statements to cut false-positive CVE alerts
A write-up on NixOS describes how generic SBOM-based vulnerability scans flag CVEs in dependencies even when the vulnerable code path isn't actually used, creating noise for maintainers and security teams. It argues that VEX (Vulnerability Exploitability eXchange) documents, which state whether a product is truly exposed to a given CVE, can be generated and applied effectively within Nix's build system to filter out irrelevant findings.