{
  "version": 1,
  "entries": [
    {
      "id": "raw-interactive-element",
      "file": "apps/web/src/features/returns/OpenReturnDialog.tsx",
      "lineHash": "aea23aaf0d3ee976d88cd69422dc28bd0f3190c4",
      "reason": "Visually-hidden file input (sr-only) triggered by Button via fileInputRef — standard accessible upload idiom, same pattern as AvatarUploadButton in components/ui. Not ad-hoc UI.",
      "approvedBy": "user",
      "date": "2026-06-10"
    },
    {
      "id": "live-secret-literal",
      "file": "apps/web/src/lib/firebase.ts",
      "lineHash": "1acfd751ec97fd1ce59e8300b6654abd25dc64de",
      "reason": "Firebase client apiKey (AIza…) is PUBLIC config, not a secret — security via Firebase Rules + authorized domains. Line-level suppression keeps rest of firebase.ts scanned for real secrets.",
      "approvedBy": "user",
      "date": "2026-06-10"
    }
  ]
}