How to reduce security-scan false positives: rule tuning, allowlists, and exception management

Too many false positives and the gate becomes theater. Tune rules, exclude paths, and suppress with an expiry — do not just turn rules off.