In reply to Amanda Rush.

false positives are probably not a bad thing when it comes to security. As such tool will look for shady code It will probably indicates bad coding practice even if not actual security problem.

plugins that fail the test are simply rejected, it should not generate more work for the plugins team.