Check a vulnerability report's concrete claims (file paths, file:line references, function names) against a real public GitHub repo's current contents. Flags claims that don't check out -- the file doesn't exist, the line is past EOF, the function isn't in the file -- which is the most common signature of an AI-generated fabricated vuln report. Does not judge whether a real, verifiable claim describes an actual security bug; it only checks whether the claim is honest about the codebase.