Scanner language coverage can exceed 100% when vendor files match

What happened

A scan can report language match coverage above 100% when a matcher finds candidates in vendor/. The scanner includes those files, but the language-statistics pass excludes them from scannedFiles.

Reproduction

On main at 4fa6722, create a temporary project with the same Express route in src/api.ts and vendor/pkg/api.ts. Run scan({ root, projectId, matcherSlugs: ["js-express-route"] }) without custom ignore paths.

Both files produce records. The TypeScript languageStats entry is { scannedFiles: 1, candidates: 2, matchRate: 2 }; the CLI formats this rate as a percentage, yielding 200%. This reproduction used only the local scanner; no agent or paid model request was involved.

Expected vs actual

The numerator and denominator should describe the same file set. Instead, RegexScannerDriver uses IGNORE_DIRS, which does not exclude vendor/, while the language-statistics glob does exclude it. The processing prompt also asks agents to skip vendored files.

Is scanning vendor/ by default intentional? If so, should the language-statistics denominator include those files? If not, should the scanner exclude them by default? I can add a focused regression test and a one-behavior fix once the intended default is clear.

Environment

• deepsec version: 4fa6722 on main
• Node: 22.21.0
• OS: macOS
• Agent backend/model: not used