Hi @spsingletary,
I confirm that we have a bug in our current C# and VB .Net analysis. We are working on it and I will come back to you as soon as it is fixed.
In the meantime you can unblock your pull requests by ignoring external roslyn error in your project like this:
Go to your project’s Administration tab > General Settings > External analyzers > C# Ignore issues from external Roslyn analyzers > enable the option. The security hotspot issues will disappear the next time your pull requests are analyzed.
We apologize for the inconvenience.
Best regards,
Nicolas