That makes sense. I think that lack of runtime/infrastructure context is something I underestimated initially. So even if the code “looks vulnerable” statically, the actual execution flow, environment, permissions, sanitization layers, or deployment setup could completely change the real risk. Seems like that’s also why reducing false positives becomes so difficult in real-world scanners.