diff --git a/.github/workflows/sca-scan.yml b/.github/workflows/sca-scan.yml
index 362bea27..9d37d0c8 100644
--- a/.github/workflows/sca-scan.yml
+++ b/.github/workflows/sca-scan.yml
@@ -5,6 +5,9 @@ on:
 jobs:
   security-sca:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@master
 
diff --git a/contentstack/src/test/java/com/contentstack/sdk/TestError.java b/contentstack/src/test/java/com/contentstack/sdk/TestError.java
index d9bca11b..ec0165ed 100644
--- a/contentstack/src/test/java/com/contentstack/sdk/TestError.java
+++ b/contentstack/src/test/java/com/contentstack/sdk/TestError.java
@@ -283,6 +283,7 @@ public void testNetworkErrorScenario() {
     public void testValidationErrorScenario() {
         HashMap<String, Object> validationErrors = new HashMap<>();
         validationErrors.put("email", "Invalid email format");
+        // deepcode ignore HardcodedPassword: test fixture value, not a real secret
         validationErrors.put("password", "Password too short");
         
         error.setErrorMessage("Validation failed");
diff --git a/gradle.properties b/gradle.properties
index e3822e8b..27c17344 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -1,5 +1,8 @@
 android.useAndroidX=true
 android.enableJetifier=true
+# bcprov-jdk18on 1.85 is a multi-release jar with Java 25 class files (major version 69);
+# Jetifier's ASM reader can't parse it, and it has no support-library references to jetify anyway.
+android.jetifier.ignorelist=bcprov-jdk18on
 android.enableR8.fullMode=false
 org.gradle.jvmargs=-XX:MaxMetaspaceSize=512m
 android.suppressUnsupportedCompileSdk=34