Weedout watches your dependency manifests and only tells you about vulnerabilities that are actually exploited in the wild or actually reachable in what you ship.