In my experience false positives are rare. You need to a take some time to actually understand the warnings to know how to avoid them, often there is some edge case lurking even the most trivial code. I see a lot of people are way too quick on dismissing the warnings, because they are overconfident that they know shell, when in fact most people don't have the slightest clue on the amounts of footguns hidden.