diff --git a/.security-review/suppressions.json b/.security-review/suppressions.json
new file mode 100644
index 0000000..bd04a35
--- /dev/null
+++ b/.security-review/suppressions.json
@@ -0,0 +1,8 @@
+{
+  "suppressions": [
+    {
+      "id": "gitleaks-generic-api-key-45",
+      "justification": "False positive. tests/test_submit_order.py defines a synthetic Google OAuth audience used only for mocked token verification. OAuth client IDs are public identifiers, this fixture is not a credential, and the tests make no real Google or AWS calls."
+    }
+  ]
+}