False positives: R-501EA fires on process.stdout.write in CLI scripts and R-5651E on a constant SQL string; both re-graded warning to error on unchanged files

[acknex2]

Two rules fire on code they do not apply to, and both were re-graded from warning to error between two scans of the same unchanged files, which turns a "no error-severity findings" merge gate permanently red.

Scans (remote SAST, same repository):

• c0b53896 (2026-09-08): both rules present at severity warning
• fa880292-8f24-4a92-b03b-5988a47031b9 (2026-09-09): same locations, now severity error
• 8c723ed3-c9f1-406d-a38f-af40d97c3b54 (2026-09-09): identical

The cited files last changed 2026-07-25, 2026-08-08 and 2026-08-10, so the re-grade is a rule-side change, not a code change.

1. R-501EA (user input reflected into an HTTP response) fires on process.stdout.write in plain Node CLI scripts

Three locations, all of this shape (scripts/capture-chatgpt-fixtures.ts:79, scripts/capture-perplexity-fixtures.ts:69, scripts/probe-claude-engine.ts:116):

// a one-off CLI script; no HTTP server, no request object anywhere in the file
process.stdout.write(`[${MODEL}] ${probe.name} ... `);
const res = await fetch('https://api.example.com/v1/responses', { method: 'POST', ... });

The description talks about res.send() / res.write() / res.end() on an HTTP response. Here res is the return value of fetch() (a Response being read, not written) and the write goes to the process's stdout. Nothing is reflected to any client. Expected: no finding when the receiver is process.stdout / process.stderr, or at least no error severity without a request-derived source.

2. R-5651E (SQL built by string interpolation) fires on a constant string

One location (scripts/verify-restore-fidelity.ts:99):

await tx.$executeRawUnsafe('SET TRANSACTION READ ONLY');

A single-quoted literal with no interpolation, no concatenation and no variables. The rule text is about queries "constructed using string interpolation or concatenation"; this one is a constant. Expected: no finding for a literal argument, or at most a note that the Unsafe API variant is in use.

Also observed in the same scans (minor, note/warning severity)

• R-438C2 (nested quantifiers / ReDoS) flags [A-Z][A-Za-z'.\-]+(?:\s+[A-Z][A-Za-z'.\-]+){0,2}: the repeat is bounded to 2 and the inner token class and the \s+ separator are disjoint, so backtracking is linear.
• R-F7958 (deprecated API version) flags the literal /api/v1/projects/... inside a third-party API URL string. That is the vendor's current endpoint; the rule seems to key on the /v1/ substring alone.

Happy to provide anything else that helps reproduce. Thanks for the tool.