Amazon Inspector Code Security (CodeGuru Security) PHP detectors produce high false-positive rate on CodeIgniter 4 — framework-mismatched rules firing on Laravel/Symfony/WordPress patterns

We enabled Amazon Inspector's code repository scanning (CodeGuru Security detectors) on a PHP 8.4 / CodeIgniter 4 application. Of 455 ACTIVE CODE_VULNERABILITY findings, the large majority appear to be false positives caused by detectors that are clearly scoped to other frameworks (Laravel, Symfony, WordPress) or to Node.js, firing on unrelated CodeIgniter/vendor-library code. A few concrete examples:

• php-laravel-eloquent-sql-injection-ide (226 of 238 "CWE-89 SQL Injection" findings) fires on CodeIgniter's Query Builder pattern $this->db->table(...)->where('column', $value), which is CodeIgniter's parameterized/bound query syntax (safe by design), not raw string concatenation. The detector appears to pattern-match on the ->where(...) call shape without recognizing CodeIgniter's binding semantics.
• php-laravel-cookie-same-site (78 of 81 "CSRF" findings) fired 40 times inside a third-party barcode-generation library (tcpdf), on code that has nothing to do with cookies or HTTP responses at all — pure array/coordinate math functions.
• php-wp-file-download-audit / php-wp-file-manipulation-audit (WordPress-specific rules) accounted for 26 "Unrestricted File Upload"/"Sendfile Injection" findings in an application that isn't WordPress.
• javascript-server-side-request-forgery-ide flagged same-origin browser fetch() calls (relative URLs, encodeURIComponent-escaped) in client-side JS as SSRF — a server-side vulnerability class being applied to browser code.

Questions:

1. Is there a way to tell the code security integration which PHP framework a repository uses, so it can weight/select detectors accordingly instead of running the full generic PHP rule set (Laravel + Symfony + WordPress + vanilla) against every repo?
2. Is there a supported way to bulk-suppress findings by ruleId (e.g., "suppress all php-laravel-eloquent-sql-injection-ide findings project-wide") rather than one-by-one, when a rule is confirmed to be a systematic framework mismatch?
3. Are third-party vendor directories (e.g., a vendored copy of tcpdf/fpdi) expected to be excluded from scanning automatically, or is there a config (.gitignore-style ignore list) we should be setting for the code security integration?

Happy to share the full finding-ID list / detector-ID breakdown if useful for reproducing this on the CodeGuru Security side.