## DAST False Positives

DAST is noisy.
*   **The "Error Page" Fallacy**: The scanner sees the word "SQL" on a page (e.g., in a blog post about SQL) and thinks it caused an error.
*   **Timeout**: The scanner slowed down the server, causing 500 errors, which it interprets as vulnerabilities.

**Verification**: always reproduce the finding manually with Burp Repeater.