>most of the results are technically correct, but, within the context of the project, not something anyone’s going to take the time to fix. I don't mind leaving "technically correct" vulnerabilities in place while there's no known way to create an exploit. If you've got a vuln with a known exploit and are relying on "but nobody is ever going to actually try that on us" - then you're part of the problem, a big part.