What a security scan cannot tell you

FXScan reads code. It does not run it. That single fact defines everything the report can and cannot claim, and it is worth being blunt about the second half.

What "no findings" actually means

It means: no rule matched. That is a weaker statement than "this resource is safe", and the difference is not academic.

Static analysis proves the presence of a pattern, never its absence. A resource can be malicious in a way nobody has written a rule for yet. The honest reading of a clean report is "nothing known-bad was found", and that is exactly how the report words it.

Where the analysis stops

Runtime-assembled behaviour. If a resource builds a string from values that only exist at runtime - a server convar, a player identifier, the current date - the scanner sees the assembly but cannot know the result. It flags the shape where the shape is suspicious; it cannot evaluate it.

Sufficiently deep indirection. Data-flow analysis follows values through assignments, calls and tables. There is a budget. A payload routed through enough layers of indirection can exceed it. Raising the budget without limit turns a scan into a hang, so there is a limit, and it is documented.

Native and compiled content. A .dll, a stripped binary or precompiled Lua bytecode is not source. The scanner records that it is there and that it cannot be read - which is itself worth knowing - but it does not analyse it.

Intent. A resource that uploads player identifiers to a remote endpoint is flagged as exfiltration. Whether that endpoint belongs to you, running your own analytics, is not a question code can answer.

What this leaves for you

Three things worth doing yourself, in order of value:

1. Read the flagged chains. Every finding shows file, line, excerpt and the data-flow path. A false positive is obvious in about ten seconds once you can see the path; so is a true one.
2. Check the endpoints. Every outbound URL the resource contains is listed in the indicators view. You know which domains you deal with. The scanner does not.
3. Ask where the resource came from. Provenance is information no analysis recovers. A resource from an author you can name is a different risk from the same code posted anonymously.

Why say all this

Because a security tool that oversells itself is worse than no tool. A report that implies certainty invites people to stop looking, and the resource that gets through is the one nobody read because the scan was green.

The scan is meant to spend your attention well - to put the twelve lines that matter in front of you instead of the twelve thousand that do not. It is not meant to replace the reading.