Problem

Secret scanning notifications use a single fixed subject/body ("Scanning detected leaked secrets") for every rule match, regardless of rule type. This is misleading for rules like the built-in Ansible Vault rule, which only ever matches the encrypted vault header ($ANSIBLE_VAULT;1.1;AES256) — the matched content is ciphertext, not a leaked secret, and committing Vault-encrypted files is normal, intended practice.

Every legitimate commit/update to a Vault file triggers an alert that a secret was "leaked," causing unnecessary triage and alert fatigue that undermine trust in genuine leak alerts. There's currently no rule attribute (severity/category/custom message) to differentiate rule types, so this can't be fixed via configuration — only worked around by allowlisting (loses visibility) or disabling/narrowing the rule (loses coverage).

Suggested solution

Add a rule attribute (e.g. matchType: ENCRYPTED_CONTENT vs PLAINTEXT_SECRET) that built-in and custom rules can set, and use it to select appropriate notification wording (e.g. "Scanning detected encrypted content" vs. "Scanning detected a leaked secret"). At minimum, update the built-in Ansible Vault rule's wording to reflect that it only ever detects encrypted content.

Alternative: allow a custom notification message per rule so admins can correct wording locally without waiting for a system-wide category distinction.