# Snyk (https://snyk.io) policy file
version: v1.25.0

# Snyk Code — exclude paths from SAST scanning
exclude:
  code:
    # Test fixtures use hardcoded credentials against an in-memory SQLite DB.
    # These are test-only and carry no production risk.
    - backend/tests/**
    # Utility scripts use env-var credentials with safe defaults for local dev only.
    - scripts/**