pip-audit checks every package in an environment or requirements file against a vulnerability database and prints them in the order it found them, with no severity. On a service with a few hundred transitive dependencies that is a list nobody can act on in one sitting. Sorting it by whether your code imports the package turns it into a short first pass.
conftest.py, noxfile.py or scripts import it. The risk is mostly to developer machines and CI, not to your users.pip-audit -f json against the environment you deploy, then feed it and your source to the triage.--fail-on-imported in CI so a newly vulnerable package your code imports blocks the merge while unreferenced noise does not.pipdeptree -r -p <package>. If the parent is something you import, treat the finding as reachable.It reads import statements as text. It cannot see an import built from a variable, a plugin loaded through an entry point, or whether the vulnerable function is ever called. It also cannot see the dependency graph, so a package your code reaches only through another package is labelled not-referenced. Not imported lowers the urgency; it is not a certificate of safety, and this is not a security audit.