AST parsing, edge cases, and hardcoded credential rule validation. Currently tracking false positives in legacy static analysis engines.