Question

A platform team at a fintech company maintains a monorepo with a large `docs/examples/` folder containing sample configuration files that intentionally include obviously fake, non-functional API tokens for tutorials. These sample files repeatedly trigger Secret Protection alerts, creating triage noise for the security team. The team wants GitHub to stop scanning that specific directory for secrets going forward, while continuing full scanning everywhere else in the repository. What is the most appropriate way to achieve this?

Accepted Answer

Add the paths to a `.github/secret_scanning.yml` file with `paths-ignore` entries to exclude the `docs/examples/` directory from secret scanning

Answer

Dismiss each alert individually with the reason 'Used in tests' and rely on GitHub to suppress future alerts for those files automatically

Answer

Disable Secret Protection for the entire repository and re-enable it only when scanning a release branch

Answer

Create a custom secret pattern that matches the fake tokens so they are grouped into a single low-priority alert