Hey everyone. I'm pretty new to DevOps, coming from a sysadmin background, so I might be missing something obvious here.
I enabled push protection on our repo, and it's flagging *everything*. Like, it blocked a push because a config file had a placeholder like `API_KEY=your_key_here`. It feels like it's catching stuff that isn't really a secret. Is this normal? How do you all manage the noise without just turning it off? I want the security, but my team is getting frustrated with the false positives.
Totally get the frustration! That initial noise is really common when you first turn it on. The "your_key_here" type flagging is because the scanner uses regex patterns - it sees `API_KEY=` and a string after it and throws an alert, even for placeholders.
What worked for us was setting up a `secret_scanning.yml` custom patterns file to exclude those placeholder patterns. You can also add paths to ignore, like `**/config/template*.json`.
It gets a lot quieter after you train it for a week or two with those custom filters. Did you try the "allow" feature for a specific finding yet? That helps the scanner learn over time.
Clean code, happy life