diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..2b5b955
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,29 @@
+# nosemgrep: package_managers.npm.npm-missing-minimum-release-age
+#
+# min-release-age is intentionally not set. The rule wants a 7-day cooldown
+# before resolving newly published versions, but @wdio/browserstack-service ships
+# reactive WDIO ops fixes that cannot wait out a release-age window. This is a
+# false positive for this repo; suppressed per Security Ops book section 6.8
+# (Fix Semgrep False Positive in SCA). Ref: SDK-7085.
+#
+# Supply-chain hardening directives for npm installs in this repository.
+#
+# access=restricted is intentionally omitted: @wdio/browserstack-service is a
+# public npm package, so publishes must default to public access.
+#
+# ignore-scripts=true is intentionally deferred. The build runs `buf generate`
+# and esbuild, both of which fetch platform binaries via npm lifecycle
+# (postinstall) scripts; enabling ignore-scripts here leaves those binaries
+# unprovisioned and breaks `npm run build` in CI. Re-enable once CI provisions
+# the buf/esbuild binaries explicitly (an npm rebuild or a pinned install step).
+#
+# engine-strict=true is intentionally deferred. engines.node is ">=18.20.0" but
+# transitive dev deps frequently target newer Node, so strict enforcement raises
+# spurious EBADENGINE failures across the multi-Node CI matrix. Re-enable once CI
+# standardises on a single LTS that satisfies all transitive engine fields.
+
+strict-ssl=true
+save-exact=true
+audit-level=high
+
+legacy-peer-deps=false