docs(security): the settled exceptions that stay say why

[maksimtech]

Why and what

The gate lists these entries as settled: their alerts are closed because the
scanners stopped reporting them, not because anything left the image.
patchradar debian on 2026-10-15 still reports gcc-14 no-dsa in trixie at
14.2.0-19 (fix only in sid, 14.4.0-3), so the flaws are still
present and only the reporting changed. The entries stay, and each now
records when the scanner fell silent and what Debian said, in the words the
CVE-2026-82560 entry already uses. Deleting a flaw that is demonstrably
present because a scanner fell silent is the one direction the file must
not drift in.

Checked, not inferred: a script read this repository's live open and closed
code-scanning alerts and listed every kept settled entry that did not say
why (4 before, 0 after), and tools/security_exceptions.py on the same
alerts still exits 1, only for CodeQL #60, which #50 fixes.

Checks

• tests/test_security_exceptions.py, tests/test_exceptions_epss.py and tests/test_nis2_evidence.py pass locally.
• The text added to each entry is wrapped at 80 columns with TOML line continuations, and tomllib parses the file.

🤖 Generated with Claude Code

[codspeed]

Merging this PR will not alter performance

⚠️ 11 benchmarks spent significant time in system calls

System calls cannot be consistently instrumented, so they are not included in the measure, which understates the real cost. Please switch to the Walltime instrument to accurately measure system calls.

Measurement and system calls

• test_nvd_fetch_cves
• test_get_watchlist
• test_add_to_watchlist
• test_api_watchlist
• test_api_stats
• test_init_db
• test_api_cves
• test_api_cves_filtered
• test_get_cves
• test_get_cves_by_software
• …and 1 more

✅ 17 untouched benchmarks

---

_{Comparing chore/settled-exceptions-reviewed (ab24418) with main (658965e)}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!