We began uploading a zip with a large number of jar files and most of them got excluded from the prescan analysis. We understand this is because they were not entry points.

However, we are seeing some odd behavior that we do not understand.

When we uploaded the large zip, two of the files that got included in the scan were (for the sake of argument) code1.jar and code2.jar. Both were scanned and both reported flaws. However, we thought another jar, code3.jar, should have been included.

If we create a new application and just upload code3.jar to it, then code3.jar is included and scanned and it reports flaws.

And if we upload just code1.jar, code2.jar, and code3.jar (whether they are zipped into one file or uploaded separately, then only code1.jar gets included from the prescan. Now both code2.jar and code3.jar are dropped.

What's going on here?