macOS scanning via CPE-only detection produces near 100% false positives - is this expected or am I missing configuration?

What I observed

When scanning a macOS target, almost all detected vulnerabilities appear to be false positives. After investigating the detection pipeline, I believe I understand why - wanted to confirm if this is expected behavior or if there's a configuration I'm missing.

How macOS detection currently works (my understanding)

From reading the source, macOS scanning works in two phases:

1. Scan phase (scanner/macos.go)

• Detects OS via sw_vers → builds OS CPE e.g. cpe:/o:apple:macos:26.4.1
• Scans .app bundles in /Applications and /System/Applications
• Extracts CFBundleIdentifier (bundle ID), CFBundleShortVersionString (version), CFBundleDisplayName

2. Detection phase (detector/detector.go)

• isPkgCvesDetactable() returns false for macOS → package-level CVE detection is entirely skipped
• Instead, CPEs are built from a hardcoded switch on bundle ID (lines ~109–182):
  • Only 10 Apple apps are mapped: Safari, Music, Mail, Terminal, Shortcuts, Calendar, Keynote, Numbers, Pages, Xcode
  • Everything else (Chrome, VLC, Zoom, VS Code, Slack, etc.) silently falls through with no CPE
• OS-level CPE cpe:/o:apple:macos:<version> is always added
• DetectCpeURIsCves() queries NVD for all built CPEs

The false positive problem

All macOS matches land at NvdVendorProductMatch (confidence score=10) — the lowest confidence level - because version matching doesn't work reliably via NVD CPE:

Root cause: NVD stores some CPE entries with version=NA (meaning "all versions"). In go-cve-dictionary/db/db.go, the match() function returns isVendorProductMatch=true unconditionally when version=NA, regardless of the actual scanned version. This means a CVE that affects e.g. apple:macos versions up to 15.2 also matches a host running 26.4.1.

Example false positive I traced:

• CVE-2023-3079 (Google Chrome V8 vulnerability) is detected on my macOS host
• Reason: NVD has a cpe:/o:apple:macos entry marked vulnerable=True for this CVE (likely an NVD data quality issue)
• vuls picks this up via the OS-level CPE - unrelated to Chrome being installed

Another pattern:

• CVE-1999-0524 (ICMP ping disclosure) matches all macOS versions because its NVD CPE entry uses version=NA - meaning it unconditionally matches every macOS host regardless of actual version

Questions

1. Is macOS scanning considered production-ready or is it acknowledged as experimental?
2. Is there a plan to support distro-level advisories for macOS? Linux benefits from GOST (go-security-tracker) and OVAL which give precise per-package CVE data which is now replaced with vuls2 now. Apple doesn't publish OVAL/GOST feeds, is there an equivalent being considered (e.g. Apple Security Releases RSS, OSV, Homebrew advisories)?
3. The hardcoded bundle ID → CPE mapping only covers 10 Apple apps. Is there a community-maintained mapping table, or a way to extend this via config without modifying the binary?
4. Is there a --confidence-over flag equivalent in config that would suppress NvdVendorProductMatch (score=10) results? I found the -confidence-over CLI flag but want to confirm this is the right way to suppress the false positives for now.

I am attaching the report for reference:

localhost.json