diff --git a/.snyk b/.snyk
new file mode 100644
index 0000000..ec61e4b
--- /dev/null
+++ b/.snyk
@@ -0,0 +1,11 @@
+# Snyk (https://snyk.io) policy file
+version: v1.25.0
+
+# Snyk Code — exclude paths from SAST scanning
+exclude:
+  code:
+    # Test fixtures use hardcoded credentials against an in-memory SQLite DB.
+    # These are test-only and carry no production risk.
+    - backend/tests/**
+    # Utility scripts use env-var credentials with safe defaults for local dev only.
+    - scripts/**