Every finding cites evidence. Static engines: Opengrep, OSV-Scanner (offline), Betterleaks, plus stack checks. Source is deleted at the end of the scan.