Fitting in
VEX documents
Answer "your product contains a vulnerable library" with a file rather than an email thread.
Both dialects
OpenVEX and CycloneDX, written beside the SBOM every time the reports are written, so a document can never describe a set of decisions that has since changed.
Only decisions somebody made
A waiver has a reviewer, a reason and a date. A triage verdict of not applicable has the sentence explaining it. Nothing else is emitted, because a VEX statement is an assertion the supplier is standing behind and "the scanner did not look" is not one.
A guess is not something to sign
The reachability pass used to feed these documents and never should have. It answers one question, whether anything in the source imports a package by name, which is a good way to sort a list and no way at all to tell somebody they are safe: nothing reads a lockfile, so every package a lockfile pulled in came back unlikely, and a library that runs on every request was being published as not_affected under this installation's name in a format built to be trusted. Nobody would write that sentence by hand. It was written a few thousand times a night. The verdict stays on the finding, where it is useful and where somebody can see how it was reached, and it makes no statement here.
One statement per advisory
Two repositories can hold the same package and reach different conclusions about it, and both were being written down. A document that argues with itself is worse than no document, so where they disagree the stronger claim is the one that stands. A finding the report files leave out is left out here too: a fixed one is fixed rather than not affected, and one somebody excepted was a decision to stop looking rather than a claim about the product.
An accepted risk is affected
A waiver that says "we will fix it next quarter" is emitted as affected with the reason attached, not as not_affected. Saying otherwise would tell a customer something untrue in a format designed to be trusted.
What it does not do
It is only as good as the decisions behind it. A VEX document generated from an empty exception table says nothing.
Every feature page carries one of those. The comparison page scores the same ground against five products people pay for, including the rows that go against us.