Not being sure it applies to this scenario and too lazy to verify, sometimes the security scanners get updated and flag previously accepted code.

… tough to make sense of flagging a readme though, unless there’s sensitive info in it.