It literally told me to look up some basic security principles and do it myself.

I think that seems like excellent advice!

Yeah their anti-hacking protections are over eager. Ask it to find bugs instead, or reasons we shouldnt deploy yet.

I hook mine up to some classical static analysys tools like sonar or codacy. Just ask it to remove the security findings and haven't had an issue. Then again, been on vacation while all this shit has happened, so don't know what to expect when I return.