Team Builds TrackBack, a Tool That Filters Python Vulnerability Alerts by Reachability

At Hacktoberfest Hack Day Sonipat, two developers spent twelve hours building TrackBack, a Python vulnerability reachability analyzer. The tool addresses alert fatigue by determining whether a known CVE in a dependency can actually be reached from a project's own code. For each alert, it reports REACHABLE with the full call path, UNCERTAIN with the reason, or NOT AFFECTED when the vulnerable code never runs. It works entirely locally by parsing pinned dependency sources, building a call graph, and tracing paths from entry points to vulnerable functions. The team says the project finished with 13 merged pull requests, 64 tests and a passing CI pipeline.