Reachability tells you code can execute. Runtime tells you it did.
Reachability vs Exploitability
Reachability says a vulnerable function could run. Exploitability proves it did. Here is how runtime evidence tells the two apart.
Security Scans Have a History: Visibility Into Every Security Scan
When a scan blocks a build or surfaces a finding, the first question is about the scan. Scan History keeps the execution record so investigations start with evidence.