[michaelt]

> Why does it matter if it's absurd in this context?

If I wanted shitty false alarms about bogus security issues, I'd get a PCI-DSS audit.