The other day I wrote a guide to help security and engineering teams prioritize and remediate thousands of such incidents. Hope it helps!

https://blog.gitguardian.com/a-practical-guide-to-prioritize...