Hi everyone. I'm still pretty new to DevOps, so I'm hoping someone can help me understand this.
We just started using GitHub Advanced Security, and the push protection feature blocked me from publishing an internal Python package. The package uses a small config file with what it flagged as a "generic secret." It's just a placeholder URL for our internal staging server, like ` http://staging.internal/api/v1/`. No real credentials at all.
Our team's workflow is to publish these packages to our private registry, and now this is stuck. I've marked it as a false positive in the UI to unblock myself, but I'm worried about doing that too often.
Is this common? How do you handle these internal URLs or configs without triggering the scanner every time? Should we be excluding certain file patterns for our internal packages? Any advice would be appreciated 😅