Static analysis tools must make trade-offs between precision and recall: being too strict produces a large number of false positives, while being too lenient misses real bugs.