These are the afternoons people actually have — with the smallest fix that restores trust.
The false-positive playbook
Classify before you suppress. Wrong path → skip_paths. Wrong scanner → disable the plugin. Deliberate pattern → suppress narrowly. High entropy, not a secret → skip asset directories.
Fix the paths first. Most first-week noise is path noise.
Right-size the scanner set. For a commit gate, secrets and patterns are usually the right pair. entropy belongs in scheduled scans.
Tune the threshold, not the coverage. Prefer --fail-on high over disabling scanners.
Re-measure. Target: under five findings per hundred files at high or above on a tuned repository.
Under five findings per hundred files is where people read them. Above that, they dismiss them. There is no third behavior.