diff --git a/.gitleaksignore b/.gitleaksignore
new file mode 100644
index 0000000..a008465
--- /dev/null
+++ b/.gitleaksignore
@@ -0,0 +1,4 @@
+# Reviewed historical false positive: the removed runtime OpenAPI check used
+# base64 of 0123456789abcdef repeated twice for its disposable SQLite database.
+# This fingerprint covers only that historical line; new commits remain scanned.
+72444dbbb11ae267e349adbf35256bd7c5be1489:scripts/verify-runtime-openapi.sh:generic-api-key:57