From 7dad128d1fb47022a9ed2df971d6da022983525d Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Tue, 21 Jul 2026 15:44:23 -0400
Subject: [PATCH] chore(security): suppress npmaudit-brace-expansion (bundled
 in latest aws-cdk-lib, synth-time only)

---
 .security-review/suppressions.json | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 .security-review/suppressions.json

diff --git a/.security-review/suppressions.json b/.security-review/suppressions.json
new file mode 100644
index 0000000..4790048
--- /dev/null
+++ b/.security-review/suppressions.json
@@ -0,0 +1,8 @@
+{
+  "suppressions": [
+    {
+      "id": "npmaudit-brace-expansion",
+      "justification": "Bundled transitive of aws-cdk-lib (node_modules/aws-cdk-lib/node_modules/brace-expansion). The latest aws-cdk-lib release (2.261.0 as of 2026-07-21) still ships the vulnerable range; npm cannot override bundled deps, so no fix is available until upstream rebundles (GHSA-3jxr-9vmj-r5cp). Exposure is synth-time only: aws-cdk-lib runs during cdk synth in CI on trusted repo input, never in the deployed Lambda/socket-mode runtime, and the ReDoS requires attacker-controlled brace patterns. Revisit/remove on the next aws-cdk-lib bump that clears npm audit."
+    }
+  ]
+}