So what do you do if “unsafe” is in a string or a comment? How do you automate the linting of it?

I believe that’s what MS is speaking about. Google probably simply puts this on the shoulders of the developer.