What is the best way to handle false positives in secret scanning?

Hey everyone! 👋 I've been rolling out GitHub Advanced Security's secret scanning across my team's repositories, and while it's fantastic at catching potential leaks, the false positive rate can be a real workflow hiccup. We had a case where it flagged a sample API key in our documentation—totally intentional, but the alert still needed handling.

I'm curious: what strategies have you all found most effective for managing these false positives **without** just turning off the rules or lowering sensitivity? I want to keep the security net strong but avoid alert fatigue for my team.

Here's what we've been experimenting with:

* **Using `secret_scanning.yml` to push false positives.** This has been our first line of defense for common non-secrets, like example placeholders.
```yaml
# .github/secret_scanning.yml
push_protection_bypassed:
- matches:
- secret_type: "generic-high-entropy-string"
- path: "docs/examples/**"
```
* **Adding `# pragma: allowlist secret` comments** right above intentional secrets in test files or configs. Super precise, but you have to remember to do it.
* **Regularly reviewing and updating custom patterns.** We found one of our own patterns was too greedy and tuned it.

My big question is about **scale and process**. How do you handle the review triage efficiently? Do you have a dedicated security person, or is it a rotating duty? And has anyone built any automation (like a bot that comments on new alerts based on path rules) to help with this?

Also, any gotchas? We learned the hard way that the `secret_scanning.yml` file needs to be on the default branch for the push protection bypass to work. 😅

Would love to hear your workflows and any clever solutions you've come up with!