docs: document affected functions for vulnerable dependency findings OD-297

docs/codacy-cloud-cli/index.md

@@ -129,6 +129,39 @@
 codacy findings gh my-org --statuses Overdue,DueSoon
 ```
 
+### Check affected functions on vulnerable dependencies {: id="affected-functions"}
+
+For SCA issues and findings linked to an advisory (CVE or GHSA) where Codacy has identified the affected functions, `issues`, `issue`, `findings`, `finding`, and `pull-request` show that information alongside the regular output.
+
+List and card views show a compact summary line:
+
+```bash
+codacy issues gh my-org my-repo
+```
+
+```
+Vulnerable functions: Unmarshal, UnmarshalOptions.Unmarshal (+1 more)
+```
+
+Detail views (`codacy issue`, `codacy pull-request ... --issue`, and `codacy finding` when the finding has no linked Codacy issue) show the full block instead:
+
+```bash
+codacy issue gh my-org my-repo <issueId>
+```
+
+```
+Vulnerable Functions (CVE-2024-24786)
+Published: 2024-03-08
+
+  • Unmarshal
+  • UnmarshalOptions.Unmarshal
+```
+
+This information is also included when using `--output json`.
+
+!!! note
+    Not every advisory lists specific affected functions — this section only appears when Codacy has identified them.
+
 ### Inspect pull requests
 
 ```bash
@@ -201,6 +234,19 @@
 
 Feed both outputs to Claude Code (with the Codacy skill installed) to decide what to fix and apply it directly.
 
+### Audit affected functions across one or multiple repositories {: id="affected-functions-scale"}
+
+The [affected functions](#affected-functions) shown for a single finding tell you whether one vulnerable dependency is reachable. To check vulnerable dependencies across one or multiple repositories at once, [install the Codacy Skills](#install-the-codacy-skills) — the `codacy-cloud-cli` skill already knows how to pull SCA findings for one or more repositories, tell direct from transitive dependencies apart, and check whether the affected functions are actually used.
+
+With the skill installed and local checkouts of the repositories you want to cover, ask your assistant directly, for example:
+
+```text
+Audit vulnerable dependencies in <repo-one> and <repo-two>. For every SCA finding where Codacy has identified affected functions, tell me whether the dependency is direct or transitive, search my local checkout for calls to those functions, and report back per repository — used/not used, chain status, and your recommendation — before ignoring anything as NotExploitable or applying an upgrade.
+```
+
+!!! note
+    Only include repositories you have checked out locally — the assistant can't verify reachability for a repository it can't search. It's also a signal, not a guarantee: review the recommendation before upgrading a dependency or ignoring a finding.
+
 ### Use the CLI in CI
 
 The CLI works in any CI environment. Set `CODACY_API_TOKEN` as a secret and install the CLI as a step:

docs/organizations/managing-security-and-risk.md

@@ -105,6 +105,24 @@
 
 ![Security and risk management finding dependency chain](images/security-risk-management-finding-dependency-chain.png)
 
+### Affected functions {: id="affected-functions"}
+
+For vulnerable dependency and container scanning findings linked to an advisory (a CVE or a GitHub Security Advisory) where Codacy has identified which functions in the dependency are affected, the finding's **Advisory Information** tab shows the list of **affected functions**.
+
+![Security and risk management finding affected functions](images/security-risk-management-affected-functions.png)
+
+Click **Check if you're affected** to copy a ready-made prompt for your AI coding assistant (such as Cursor, Claude Code, or GitHub Copilot). The prompt asks your assistant to search your repository for calls to the affected functions and recommend whether to upgrade the dependency or, if the functions aren't used, ignore the finding as **Not exploitable**.
+
+!!! note
+    This is a signal, not a guarantee. Review your coding assistant's findings before upgrading a dependency or ignoring a finding.
+
+!!! note
+    Not every advisory lists specific affected functions — some vulnerabilities (for example, configuration issues) aren't tied to specific functions, so this section doesn't appear for every finding.
+
+Affected functions are also available from the terminal — see [checking affected functions with the Codacy Cloud CLI](../codacy-cloud-cli/index.md#affected-functions).
+
+To review reachable dependencies across one or multiple repositories at once, instead of one finding at a time, see [auditing affected functions across one or multiple repositories](../codacy-cloud-cli/index.md#affected-functions-scale) with the Codacy Cloud CLI.
+
 ### Severity changes {: id="severity-changes"}
 
 The same Common Vulnerability and Exposure can be classified with different severities in different sources, like cve.org or NVD, and Trivy uses these and other sources to update their database. As such, there may be situations where the severity attributed to a Finding by Trivy is not in line with a specific source. Subsequent analysis can then close a Finding and re-open it with a different severity, if a Trivy database update occurs.