I built a vulnerability scanner that refuses to lie to me

Static analysis tools have a trust problem. They read your source, pattern-match something that looks...