Credentials

Exclude one credential everywhere it appears

A credential is identified by a fingerprint, which is a hash of the value itself. Two findings with the same fingerprint are the same secret, wherever they are. That is what makes one decision cover all of them.

What to do

Open the finding and copy its fingerprint. It is on the detail page, next to the masked value, and it looks like cred:f960f486dcc3fe6d.
Go to Exclusions and press New exclusion.
Set the type to credential and paste the fingerprint into the fingerprint field. Leave the organization, repository and path as *, because the whole point is that the decision follows the secret rather than the place.
Write a reason somebody else will understand in a year, and set an expiry. An exclusion with no expiry is permanent until somebody notices.
Save. Every finding with that fingerprint moves out of the work list on the next scan, and stays in the report marked as excluded with your name and reason on it.

A tip

The prefix is optional. A rule written as f960f486dcc3fe6d and one written as cred:f960f486dcc3fe6d both match, because rules written by hand and rules moved from an older installation disagree about it and neither should silently fail.