I have an app that if I scan with v21.2, it tells me I have XSS: Reflected in it. If I scan it with v22.1, it doesn't. Both are running with the same exact rulepacks and both are invoking the scan the exact same way (offloaded translation to ScanCentral). From what I can tell, it SHOULD be reporting the XSS issue, but maybe I'm wrong.