Sample reports
Real runs against open-source projects, published whole. Every verdict carries the evidence behind it, and the risk-context.yaml that produced it is available beside each report.
Pick a project you know. A deferral is only worth something if you can check the reasoning against code you recognize, so these are not illustrations built to look good. They are what the tool produced, and none of them found anything to fix today.
Redash v26.3.0
29 of 272 alerts need attention. 243 defer in every context they appear in.
The one to read first. Four execution contexts (server, worker, browser-bundle, build), alerts that carry different verdicts in different contexts, and three alerts the analysis could not finish without a deployment fact only the owner has.
JupyterLab 4.6.0 (workstation stack)
Two findings reach untrusted notebook content in the delivered product. The other 64 alerts defer.
Modeled as JupyterLab delivered as part of a packaged data science workstation stack. So reachability depends on the shipped configuration and deployment scenario instead of a simple first-party call graph. Both scheduled findings were traced to file and line in the delivered bundle.
NetBox v4.6.5
One advisory, carried by two alerts, needs scheduling in the web tier. Everything else defers.
A small backlog, read end to end in a few minutes. The scheduled finding has a traced call path from a dashboard widget any authenticated user can set.
Spring PetClinic microservices (Spring Boot 4, 8 services)
Nothing needs fixing today. 109 alerts are scheduled: 18 with a traced path from an anonymous caller, 91 on the public gateway by policy floor. 580 defer with stated evidence.
A Java microservices monorepo: 123 distinct advisories recur across eight services, so the same advisory scores differently depending on which service runs it. The report traces request smuggling at the internet-facing gateway and defers the matching framing advisories on the services behind it, because the gateway rewrites HTTP framing before forwarding a request. Test-scope dependencies score against the dev lifecycle they actually run in rather than production.
Read the Spring PetClinic microservices (Spring Boot 4, 8 services) report
What you will not find in any of these reports
No sample contains a FIX_TODAY verdict, and nothing was tuned to produce one. No alert in any of the four projects is listed in KEV, and none reaches the top 1% of EPSS that the rubric treats as imminent threat. That is what well-maintained open-source projects actually look like, and it is why the reports spend their length on evidence for deferral rather than on urgency.
All four runs used a fictional vulnerability management policy, the SafeCo Vulnerability Management Policy (ISP-07), so the samples stay comparable. In a real run the remediation deadlines come from your organization’s own policy.