From hackernews.

GitLab security scanning has a similar issue of false positives (many Node security vulns in frontend-only code). But at least they can be marked as resolved!