Vulnerabilities: Clarified information on macOS built-in Python (#45226)

- Also move false positives call out box higher up

articles/vulnerability-processing.md

@@ -22,6 +22,8 @@ Fleet detects vulnerabilities for these software types:
 | Packages            | Python, Homebrew, npm  | Python, Atom, Chocolatey, npm | ✅ <p>For Ubuntu, RHEL, and CentOS: packages defined in the [OVAL definitions](https://github.com/fleetdm/nvd/blob/master/oval_sources.json), except for vulnerabilities involving configuration files</p><p>For Fedora (up to Fedora 40, released June 2024), packages defined in RHEL OVAL definitions [mapped by version](https://github.com/fleetdm/fleet/blob/main/server/vulnerabilities/oval/parsed/utils.go).</p><p><p>For Amazon Linux, packages maintained by Amazon by checking [ALAS advisories](https://alas.aws.amazon.com/).</p> |
 | IDE extensions      | VS Code, [VS Code forks](https://fleetdm.com/tables/vscode_extensions) (i.e. Cursor), and [JetBrains IDEs](https://fleetdm.com/tables/jetbrains_plugins) (i.e. IntelliJ IDEA) | VS Code, [VS Code forks](https://fleetdm.com/tables/vscode_extensions) (i.e. Cursor), and [JetBrains IDEs](https://fleetdm.com/tables/jetbrains_plugins) (i.e. IntelliJ IDEA) | VS Code, [VS Code forks](https://fleetdm.com/tables/vscode_extensions) (i.e. Cursor), and [JetBrains IDEs](https://fleetdm.com/tables/jetbrains_plugins) (i.e. IntelliJ IDEA)                                                                                                                                                                                                                                                                                                                                   |
 
+> If you find that Fleet is incorrectly marking software as vulnerable (false positive) or missing a vulnerability (false negative), please file a [bug](https://github.com/fleetdm/fleet/issues/new?template=bug-report.md). When false positives are fixed, it may take two hours for the false positives to disappear after upgrading Fleet. You can speed up this cleanup by running the vulnerabilities job manually.
+
 Linux kernel vulnerabilities with known variants (ie. `-generic` or `kernel`) are detected using OVAL. Custom kernels (unknown variants) are detected using NVD.
 
 Currently, only software names with all ASCII characters are supported. Vulnerabilities won't be detected for software with names featuring non-ASCII characters, such as Cyrillic, or software that has been renamed from its default name (e.g. "Chrome 2" instead of "Google Chrome"). For some software, Fleet uses [custom rules](https://github.com/fleetdm/fleet/blob/main/server/vulnerabilities/nvd/cpe_translations.json) to mitigate these issues on an app-by-app basis.
@@ -32,8 +34,7 @@ Vulnerabilities that only impact software on specific operating systems may not
 
 Vulnerabilities that only impact specific software configurations are still reported. For example, Fleet will mark the [curl Homebrew package](https://formulae.brew.sh/formula/curl) with [CVE-2023-28320](https://nvd.nist.gov/vuln/detail/CVE-2023-28320) even if curl is not forced to use synchronous resolvers.
 
-If you find that Fleet is incorrectly marking software as vulnerable (false positive) or missing a vulnerability (false negative), please file a [bug](https://github.com/fleetdm/fleet/issues/new?template=bug-report.md). 
-> **Note:** When false positives are fixed, it may take two hours for the false positives to disappear after upgrading Fleet. You can speed up this cleanup by running the vulnerabilities job manually.
+On macOS, Fleet reports vulnerabilities in the built-in Python. This version is managed exclusively by Apple, isn't intended for user workloads, and can't be patched, upgraded, or removed without breaking macOS system services. These vulnerabilities can be safely ignored.
 
 ## Sources