The static analysis scan is VERY primitive. You can think of it mostly as a regex scraper that looks for “patterns” in your code with zero actual context.
So if you’re positive you’re not using ECP in your app, then maybe look around for places where you’re building URLs, storing integers, etc. Maybe they’re getting tripped up when seeing “:8060” somewhere in your code? or /launch or some other string that matches what they have in the ECP docs.
http://<IP of Roku>:8060/launch/[dev | channeID]?contentId=<content ID>&MediaType=<mediaType>
Have you tried running the static analysis tool locally to see if you can reproduce the errors there? Might help you more quickly discover the place in code that’s tripping up the rule.