diff --git a/strix/tools/reporting/tool.py b/strix/tools/reporting/tool.py index d2d9a688..791bae79 100644 --- a/strix/tools/reporting/tool.py +++ b/strix/tools/reporting/tool.py @@ -1876,10 +1876,6 @@ def _build_dependency_evidence( evidence += f"\n\n**Usage analysis:** {label}." if reachability_evidence and reachability_evidence.strip(): evidence += f" {reachability_evidence.strip()}" - evidence += ( - " This is a prioritization signal from static analysis, not a" - " proof of exploitability or of safety." - ) return evidence diff --git a/tests/test_reporting_fields.py b/tests/test_reporting_fields.py index 258fef1c..558a2b64 100644 --- a/tests/test_reporting_fields.py +++ b/tests/test_reporting_fields.py @@ -663,7 +663,6 @@ async def test_dependency_report_records_reachability(report_state: ReportState) == "src/render.ts:14 calls `_.template()`." ) assert "**Usage analysis:**" in report["evidence"] - assert "not a proof of exploitability or of safety" in report["evidence"] # The level must never influence the rating — that comes from the contextual # breakdown, or from advisory_cvss when no breakdown applies. assert report["severity"] == "high"