I Claimed 12 Critical Security Bugs. Most Were False Positives. Here's What I Learned.

Update (Sept 4): After manual verification of every finding, I'm correcting this article. The original version claimed 12 critical vulnerabilities. On deeper review, most were false positives from my regex-based scanner. The scanner flags patterns without understanding context — whether variables come from user input or internal config, whether sanitization exists nearby, whether the pattern is intentional by design. I'm leaving the technical analysis below but with honest verdicts. This is a lesson in verifying scanner output before publishing.

What Happened

I built AIVerify, a regex-based SAST scanner, and ran it against popular GitHub repos. The scanner flagged patterns like f-strings in SQL queries and subprocess calls with shell=True. I published the results without manually verifying each finding against the actual source code context.

That was a mistake.

What the Scanner Actually Found (Verified)