Large number of false positive security vulnerabilities

Problem

When a security scan is performed, it reports back with a high number of false positive security vulnerabilities.

Solution

Supress the false positives with:

<suppress>
    <notes><![CDATA[newrelic-agent false positives due to the instrumentation package]]></notes>
    <filePath regex="true">.*newrelic-agent-.*\.jar[\\\/]instrumentation.*\.jar</filePath>
    <cpe regex="true">.*
</suppress>

Cause

The security scan flagged the .jar files as vulnerable due to the class and method names we use to identify sources for instrumentation. However, our instrumentation code is not part of the vulnerable libraries and the vulnerable libraries do not exist in our .jar files, which contain only New Relic code.