Vulnerability scanning is a crucial part of identifying application security weaknesses, but come with false positives