The line-scan engine treated # and // as comment markers in every language. That sounds harmless until you notice what it was cutting off: Bash URLs with # fragments, TypeScript private fields starting with #, and PowerShell comments that weren’t comments at all.
Language-aware stripping recovered 81 real findings across 2,915 files, with zero new false positives.
What broke
A single shared comment stripper ran before pattern matching. It knew two markers. Real codebases use more, and they use those markers for things that aren’t comments.
The fix
Each language plugin now owns its own comment syntax. The shared stripper consults the language config, not a hard-coded pair of characters. The recovery landed as a pure precision win: more true positives, same false-positive floor.
See the tiers that classify what we do with those findings in Why three tiers?.