diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 0000000..925b00d
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,9 @@
+# Scan shipped JS/TS (sdk/typescript). Local sanity harnesses read
+# ACCOUNTBLOX_ADDRESS / TEST_WALLET_*_PRIVATE_KEY from process.env and log
+# public contract addresses; js/clear-text-logging taints all process.env
+# and files High alerts that are not credential leaks.
+name: Bloxchain Protocol JS/TS
+paths-ignore:
+  - scripts/sanity/**
+  - scripts/sanity-sdk/**
+  - scripts/count-loc.cjs
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9de6545..4b6986a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -35,6 +35,7 @@ jobs:
         with:
           languages: javascript-typescript
           build-mode: none
+          config-file: .github/codeql/codeql-config.yml
 
       - name: Perform CodeQL analysis
         uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7