Reporting

Answer a customer asking about a vulnerability in your product

A customer runs a scanner against something you shipped, sees a vulnerable library in it, and asks. The answer is usually "we ship it but nothing calls it", and saying that in prose starts an argument that a document ends.

What to do

Make the decision in the product, on the finding, with a reason. A VEX document only carries decisions somebody actually made.
If the vulnerable code genuinely cannot be reached, record that as the triage verdict with the sentence explaining why.
If it can be reached and you have accepted the risk for now, record it as an exception with the reason and the date.
Open Reports and take the OpenVEX or CycloneDX VEX file, whichever their tooling reads. Both are written on every scan, beside the bill of materials.
Send them the bill of materials and the VEX file together. One says what is in the product, the other says which of it matters.

Worth knowing

An accepted risk is emitted as affected, with the reason attached, never as not affected. Telling a customer they are safe when the decision was actually "later" is the one thing a VEX document must never do.