My fix ended up being two things stacked together. First, I started pulling my eggs out of the walk-in a good 30 minutes before service instead of cracking them straight from the cold shelf, which made a bigger difference than I expected. Second, I switched to a towel ring under the bowl so it wouldn't slide while I was whisking one handed during a rush. The breaking stopped about week 3 after that and I stopped messing with it.

Oh boy, been there. A buddy of mine ran a scan on his company's test site and got something like 60 alerts, and about 50 of them were the same missing security headers over and over. He ended up writing a small config file that just tells ZAP to skip those known rules, and it cut his list down to about 6 real things worth a look. The rest he just marks as accepted risk and moves on. Tuning the rules is really the only sane way to deal with it, in my view. Trying to review every alert by hand will eat your whole week.