I found 10 bugs in my own security scanner. Here's what they taught me about false positives.

I built a VS Code extension that scans code for leaked secrets, PII, and security vulnerabilities before you commit. A few weeks in, I sat down and did something most tool builders put off: I went loo...