From 2a7d8af1f710ed75945fc1b0df6af787d08e50d0 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 31 Jul 2026 11:53:53 -0400
Subject: [PATCH] chore(security): suppress public OAuth fixture

Document the scanner false positive without suppressing any runtime credential flow.
---
 .security-review/suppressions.json | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 .security-review/suppressions.json

diff --git a/.security-review/suppressions.json b/.security-review/suppressions.json
new file mode 100644
index 0000000..bd04a35
--- /dev/null
+++ b/.security-review/suppressions.json
@@ -0,0 +1,8 @@
+{
+  "suppressions": [
+    {
+      "id": "gitleaks-generic-api-key-45",
+      "justification": "False positive. tests/test_submit_order.py defines a synthetic Google OAuth audience used only for mocked token verification. OAuth client IDs are public identifiers, this fixture is not a credential, and the tests make no real Google or AWS calls."
+    }
+  ]
+}