Four false positives in four vulnerability classes had one root cause: the scanner accepted something it had caused as proof. A template matched a marker it had put in the request. An SSRF probe counted a callback our own client made. Here are the four, and the five rules that now stop them, each enforced in code rather than by review.