diff --git a/.security-review/suppressions.json b/.security-review/suppressions.json
index ef384a42..aaaa23fe 100644
--- a/.security-review/suppressions.json
+++ b/.security-review/suppressions.json
@@ -1,5 +1,25 @@
 {
   "suppressions": [
+    {
+      "id": "AUTHZ-CLEAN-AUTOAPPROVE-INJECTION-001",
+      "title": "Clean-review auto-approve derives APPROVE authority from a model-controlled signal on the untrusted auto-review path (prompt-injection-mintable APPROVE)",
+      "file": "agent/tools/publish_review.py",
+      "severity": "high",
+      "status": "confirmed",
+      "suppression_justification": "ACCEPTED (Adam, 2026-07-21) as a knowingly-deferred risk merged into the dev integration branch via admin merge in PR #217. /sh-security-review returned BLOCK: moving `approve` authorization from the deterministic verdict_requested flag to open_findings_count==0 lets a prompt-injected auto-review (which never sets verdict_requested) land a real bot APPROVE on an attacker-controlled external/fork PR, potentially satisfying branch protection. This reintroduces the hole PR #214 closed. Merged to dev only (NOT main/prod). Compensating controls: (a) confirm dev does not auto-deploy to sh-openswe; (b) on sensitive repos, esp. payments-dashboard, configure rulesets so the seahaven-openswe[bot] APPROVE does not by itself satisfy required approvals. Tracked in issue #218 with the full redesign checklist. REVISIT TRIGGER: MUST be resolved before this change promotes from dev to main/prod, and immediately if dev is found to auto-deploy. Verified HIGH by the sh-security-review detector fan-out (6 independent detectors converged).",
+      "owner": "adam@seahavenind.com",
+      "added": "2026-07-21"
+    },
+    {
+      "id": "AUTHZ-CLEAN-AUTOAPPROVE-THREADLAUNDER-002",
+      "title": "Clean-review auto-approve gate reads reconcile-derived finding status, so a PR author can launder a dirty PR to clean via GitHub thread resolve/outdate",
+      "file": "agent/tools/publish_review.py",
+      "severity": "high",
+      "status": "confirmed",
+      "suppression_justification": "ACCEPTED (Adam, 2026-07-21), deferred with AUTHZ-CLEAN-AUTOAPPROVE-INJECTION-001 in PR #217 (admin-merged to dev). The open_findings_count gate reads finding status after reconcile_findings_with_review_threads, which flips open->resolved when the GitHub thread is is_resolved/is_outdated — both author-controllable ('Resolve conversation' or a trivial hunk-outdating commit) without fixing the defect, yielding an auto-approve on an unfixed PR. Same compensating controls and revisit trigger as ...-001. Tracked in issue #218 (redesign: compute the gate from the reviewer's own authoritative finding state, not author-influenced thread state). Verified HIGH by /sh-security-review.",
+      "owner": "adam@seahavenind.com",
+      "added": "2026-07-21"
+    },
     {
       "id": "AUTHZ-SLACK-BOT-DEFAULT-001",
       "title": "Slack entrypoint lacks a per-user repo-access check; default-bot PR authoring removes the implicit per-user repo boundary",