Security Misconfiguration Is a Runtime Fact

Debug mode on in production, a missing Content-Security-Policy header, a wildcard CORS policy, an open port — these are properties of the deployed system, not literals sitting in your source for a sca