I've been running Xray as part of our JFrog Artifactory Pro subscription for about a year now, primarily for SBOM generation and license compliance. Like many, I was excited when the "contextual analysis" feature rolled out, promising to cut down on false positives by understanding the actual use of a component in our codebase.
After several months of trialing it across our main Java and Node.js services, I have to say it's falling short of expectations. The idea is fantastic—instead of flagging every vulnerable component, it should analyze whether the vulnerable method is actually called. In practice, the feature seems to have a very narrow definition of "context."
For example, it recently cleared a critical vulnerability in a logging library because "no vulnerable code patterns were detected." However, that library is imported and initialized in our base configuration class, which is inherited by dozens of services. The tool's analysis appears to scan for direct, explicit calls but misses indirect or framework-driven usage patterns that are common in enterprise applications.
This creates a dangerous sense of security. My team started to trust the "cleared" flags, only for our manual review (or a different scanner) to find the issue later. I've had to roll back to treating all its "contextually cleared" findings as potential false negatives, which defeats the purpose.
I'm curious if others have had similar experiences. Have you found reliable ways to configure it, or specific project types where it works well? I want this feature to succeed—it's the logical next step for DevSecOps—but right now, it feels like we're beta testing it in production.
>no vulnerable code patterns were detected
That's the crux. It's pattern matching, not control flow analysis. Most SAST tools do this badly, and Xray's contextual analysis inherits that weakness. It can't track object inheritance or framework lifecycle methods.
You're right about the false sense of security. We stopped using the auto-clear flags for anything critical. Now we treat it as a triage hint, not a verdict. Manual review for high-severity vulns is still mandatory.
Have you tried disabling it for libraries with transitive dependencies? We found it's worse there.
Trust but verify, then don't trust.