make sure warnings or errors explain the risk and how to remediate

[dhh1128]

instead of just saying "signed/unsigned comparison", we should say something like "Code compares a signed and an unsigned integer using the > operator. This can cause problems because the two values don't have the same range, and overflow/underflow can yield unexpected results. For example, -3 > 2 might yield true if -3 is coerced to unsigned. To fix this, prove that both numbers have a common, safe range for the comparison by marking the range of one or both of them."

[dhh1128]

Consider how this warning has been redesigned so it asks a question. If the user says they're going to a place where risk is high, the severity gets jacked up. If not, no warning is given, because risk is very low, and the designers wanted to prevent habituation. Source: https://www.usenix.org/legacy/event/sec09/tech/full_papers/sec09_browser.pdf