Good question, for now, the false positive is not handled. One solution is to keep a false positive whitelist (also a bloom filter) in server side, only when the first user reports the false positive url, the link will be joint into the whitelist, then timely distribute to client.