One thing about most security scanners, they’re usually predisposed to deliver false positives. The idea is that if the machine isn’t 100% sure, it will send up an alert for a user to take a closer look and make the judgement call. Seems to me the system worked just fine.