Content Quality: Clear Briefing (726 words by whitespace count, within the 300-800 range; title 120 characters, under the 150 cap). Structure covers mechanism, the four verdicts, availability, timing, limits and unknowns. Human_requested is false.
Source Verification: Read all three gzipped snapshots (source-0, source-1, source-2 .html.gz), extracted to text, and re-fetched all three live URLs with curl on 2026-11-01: live raw HTML sha256 is identical to each snapshot sha256 in the manifest, so there are no live-vs-snapshot differences. suspicious_patterns is null for all three. github.blog and docs.github.com are both on config/source_allowlist.txt by exact hostname (lines 889 and 2650). Source 0 (github.blog changelog, October 28, 2026): confirms 'now in public preview for JavaScript and TypeScript'; quotes 'looks for call paths from your code to the vulnerable functions in your dependencies and shows the evidence on each alert', 'so there’s nothing to install or maintain', 'they never close or dismiss an alert', 'can take from a few minutes to a few hours' all verbatim; CodeQL builds a call graph across the repository and its dependencies; exactly four verdicts (Reachable, Potentially reachable, Unreachable, Reachability unavailable) with the definitions and 'treat as reachable' / 'lower priority' / 'triage as you normally would' guidance as stated; Cost: Free, no GitHub Advanced Security license needed, Actions minutes not billed; Plans: GitHub Enterprise Cloud incl. data residency; Languages: JS/TS with npm, Yarn or pnpm lockfile; GitHub-hosted runners only; monorepos / multi-directory manifests may be unsupported; runs over three hours may show 'Reachability unavailable'; advisory coverage is all GitHub-reviewed JavaScript advisories receiving Dependabot alerts; off by default, enabled via custom security configuration or repository Settings > Advanced Security; Dependabot alerts must be on; daily reruns while open alerts exist; filter/sort on repo and org alert pages; REST API. Source 1 (docs reachability concepts page): confirms public preview 'subject to change', 'CodeQL static analysis and curated data identifying the affected functions', availability on public/private/internal repositories on GHEC with no GitHub Code Security license required, up to five sample call paths that are not exhaustive, pushes do not trigger scans, three-hour scan limit, 'A reachable function is not necessarily exploitable', Unreachable is 'not a guarantee that a dependency is safe', 'You shouldn't close or dismiss an alert solely based on its reachability verdict'. Source 2 (docs Dependabot alerts page): confirms optional enablement and 'Use reachability alongside severity, Exploit Prediction Scoring System (EPSS) scores, dependency scope, and dependency relationship'. Every body URL is in article.sources and vice versa (no orphans). Minor nuance, not an error: the docs verdict table defines Potentially reachable more narrowly (includes calls found only outside a manifest's directory in multi-manifest repositories) and describes Reachability unavailable as including unsupported ecosystems and failed scans; the article follows the changelog wording, which is accurate to its attribution. The docs also list a no on-demand/scheduled scan limitation the article omits; omission only. First-party only: all three sources are GitHub pages; the article states this plainly in What We Don't Know and attributes every claim to GitHub, so neutrality toward competing developer-security tools is preserved.
Factual Accuracy: All numbers, dates, quotes and attributions verified individually against raw snapshot text. The count of four verdicts is correct. Public preview wording, JS/TS scope, GHEC-only plan scope (including data residency), CodeQL-based static analysis, no-billing statement (scoped to the preview and to Actions minutes / no GHAS license) and the no-auto-dismiss statement all match. Summary and headline are fully supported.
Overall Assessment: Accurate, well-sourced Briefing ready for publication; first-party-only sourcing is disclosed. Featured candidacy: 1 - accurate preview-feature coverage for a defined enterprise developer-security audience, limited to GitHub Enterprise Cloud and JS/TS