Why does Mend flag so many false positives in Python packages?

Hi everyone. I'm still getting used to Mend at my company, and I keep running into something confusing with our Python projects.

It seems to flag a lot of vulnerabilities that our devs say are false positives, especially in transitive dependencies. For example, it recently flagged a medium-severity issue in a `urllib3` version that's buried deep in a dependency chain, but the actual exploit path doesn't apply to our use case. This creates a lot of noise and makes prioritizing real issues tough.

Is this a common experience with Python ecosystems? Are there specific settings in Mend or patterns in Python packaging that lead to this? Any advice on tuning it to reduce the noise would be really appreciated.