diff --git a/.security-review/suppressions.json b/.security-review/suppressions.json
index 6729f1f..46f9dd9 100644
--- a/.security-review/suppressions.json
+++ b/.security-review/suppressions.json
@@ -7,6 +7,10 @@
     {
       "id": "gitleaks-generic-api-key-5",
       "justification": "False positive. Same public reCAPTCHA v3 SITE key as gitleaks-generic-api-key-7, flagged at assets/js/form.js:5 from an earlier commit (gitleaks scans git history). Public by design, not a secret. INFRA-143."
+    },
+    {
+      "id": "gitleaks-generic-api-key-2464",
+      "justification": "False positive. gitleaks flags a high-entropy string at wp-content/plugins/elementor-pro/assets/js/notes/vendors-...-e4587e.js:2464 (a minified radix-ui vendor bundle: the token is a bundler variable, not a credential). This legacy WordPress/Elementor bundle was removed from the repo and survives only in git history, which gitleaks scans. Not a live secret, nothing to rotate. INFRA-181."
     }
   ]
 }