From af41570ae9ea8c5e6c82350c665ed4888413a9e2 Mon Sep 17 00:00:00 2001
From: ajmallesh <ajmallesh@gmail.com>
Date: Tue, 2 Dec 2025 19:07:37 -0800
Subject: [PATCH] docs: add Windows Defender false positive guidance

Closes #16
---
 .dockerignore | 1 +
 README.md     | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/.dockerignore b/.dockerignore
index e4a034a..c03a091 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -7,6 +7,7 @@ yarn-error.log*
 # Runtime directories
 sessions/
 deliverables/
+xben-benchmark-results/
 .claude/
 
 # Git
diff --git a/README.md b/README.md
index 1e7e6b4..1343dbf 100644
--- a/README.md
+++ b/README.md
@@ -429,6 +429,9 @@ Shannon is designed for legitimate security auditing purposes only.
 - **Time**: As of the current version, a full test run typically takes **1 to 1.5 hours** to complete.
 - **Cost**: Running the full test using Anthropic's Claude 4.5 Sonnet model may incur costs of approximately **$50 USD**. Please note that costs are subject to change based on model pricing and the complexity of the target application.
 
+#### **6. Windows Antivirus False Positives**
+
+Windows Defender may flag files in `xben-benchmark-results/` or `deliverables/` as malware. These are false positives caused by exploit code in the reports. Add an exclusion for the Shannon directory in Windows Defender, or use Docker/WSL2.
 
 
 ## 📜 License