diff --git a/.security-review/suppressions.json b/.security-review/suppressions.json
new file mode 100644
index 0000000..6729f1f
--- /dev/null
+++ b/.security-review/suppressions.json
@@ -0,0 +1,12 @@
+{
+  "suppressions": [
+    {
+      "id": "gitleaks-generic-api-key-7",
+      "justification": "False positive. assets/js/form.js:7 SITE_KEY is a Google reCAPTCHA v3 SITE key, which is public by design: it is shipped to every browser and passed to grecaptcha.execute() client-side (form.js:17,63). It is not a secret and must not be rotated. Pairs with the reCAPTCHA SECRET key held server-side. INFRA-143."
+    },
+    {
+      "id": "gitleaks-generic-api-key-5",
+      "justification": "False positive. Same public reCAPTCHA v3 SITE key as gitleaks-generic-api-key-7, flagged at assets/js/form.js:5 from an earlier commit (gitleaks scans git history). Public by design, not a secret. INFRA-143."
+    }
+  ]
+}
diff --git a/package-lock.json b/package-lock.json
index 5a9e449..820c13f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -743,9 +743,9 @@
       }
     },
     "node_modules/gray-matter/node_modules/js-yaml": {
-      "version": "3.14.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
-      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
+      "version": "3.15.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz",
+      "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==",
       "license": "MIT",
       "dependencies": {
         "argparse": "^1.0.7",
diff --git a/package.json b/package.json
index 06f325d..18a7b80 100644
--- a/package.json
+++ b/package.json
@@ -11,5 +11,10 @@
   "license": "UNLICENSED",
   "dependencies": {
     "@11ty/eleventy": "3.1.6"
+  },
+  "overrides": {
+    "gray-matter": {
+      "js-yaml": "^3.15.0"
+    }
   }
 }