IMHO, it would be very helpful to the user universe to drop static assets from the scope by default for injection scanners carrying attack payloads in the URL.
For example
`
https://base_url/main.js?bla&bla`.
The server will strip the params and serve the js file, with no chance of the payload being processed by the application, this request becoming a waste of time.
Another story would be an API endpoint for `
https://base_url/main` where the backend will process the parameters if it's an existing endpoint. In this case, a default to exclude .js files would not skip this.
Thanks