in-scope and out-of-scope generate as *URL, so any file that uses them fails to load

InScope and OutOfScope in generated_types.go are *URL, but the schema declares both as string lists, so si.Load fails on any file that uses in-scope or out-of-scope. The loader is strict, so one bad field rejects the whole file and the project never learns its insights were not read (this happened to Project-HAMi/HAMi-core, which had to delete the fields). The @go(InScope,type=*URL) override in schema.cue looks copied from the neighbouring URL fields, so dropping type=*URL and regenerating should fix it.

error unmarshalling SI: [22:7] cannot unmarshal []interface {} into Go struct field SecurityInsights.Project of type si.URL
  21 |     in-scope:
> 22 |       - remote code execution in the server

Start with the InScope and OutOfScope definitions in v2/si/generated_types.go and the corresponding @go overrides in schema.cue. Regenerate the Go types after correcting the schema mapping, then verify that si.Load accepts files containing in-scope and out-of-scope string lists without the reported unmarshalling error.