Why my security scanner refuses to tell you your code is clean

There is a failure mode in security tooling that almost nobody instruments for, and once you see it...