The registry scanner reads Markdown as source. On ComfyUI-SmartQueue 0.1.6,
four of the nine findings came from SECURITY.md and CHANGELOG.md quoting the
call syntax they were explaining, so the document meant to reassure a reviewer
raised its own package's finding count.
Names every construct in prose instead of quoting call syntax, and says up
front why, so nothing reads as evasion.
Written for registry reviewers, so a pattern-scanner report does not have to
be reverse-engineered into intent. Covers the input_folder containment
(realpath + commonpath, gating reads as well as writes), the removal of the
browse route and its process launch in 1.1.5, the UNC prescreen, and a table
of known scanner matches with why each is a false positive.
rubz