diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index ac7dad02..d9f2fb34 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,4 +1,5 @@
 * @contentstack/developer-ecosystem-pr-reviewers
 .github/workflows/ @contentstack/security-admin
 **/.snyk @contentstack/security-admin
-**/CODEOWNERS @contentstack/security-admin
\ No newline at end of file
+**/CODEOWNERS @contentstack/security-admin
+**/.gitguardian.yaml @contentstack/security-admin
\ No newline at end of file
diff --git a/changelog.md b/changelog.md
index 0f211e6a..5b945f25 100644
--- a/changelog.md
+++ b/changelog.md
@@ -8,9 +8,10 @@
 
 ## v1.15.0
 
-### Oct 21, 2026
+### Nov 02, 2026
 
 - Feat: Added the opt-in `Contentstack.Builder.setSerializeNulls(boolean)` option. When enabled, `null` values in request bodies are sent to the API instead of being dropped, so a field's value (for example a Number field on a localized entry) can be cleared. Off by default; existing behavior is unchanged.
+- Tests: Replaced hardcoded usernames and API keys in `LoginDetailTest` and `TestClient` with generated values to resolve Snyk Code findings (DX-22133, DX-22134). No change to the published artifact.
 
 ## v1.14.1
 
diff --git a/src/test/java/com/contentstack/cms/TestClient.java b/src/test/java/com/contentstack/cms/TestClient.java
index be53c9f5..06239356 100644
--- a/src/test/java/com/contentstack/cms/TestClient.java
+++ b/src/test/java/com/contentstack/cms/TestClient.java
@@ -1,5 +1,6 @@
 package com.contentstack.cms;
 
+import java.util.UUID;
 import com.contentstack.cms.core.Util;
 import com.contentstack.cms.stack.Stack;
 import io.github.cdimascio.dotenv.Dotenv;
@@ -17,8 +18,8 @@ public class TestClient {
     public final static String USER_ID = (env.get("userId") != null) ? env.get("userId") : "c11e668e0295477f";
     public final static String OWNERSHIP = (env.get("ownershipToken") != null) ? env.get("ownershipToken")
             : "ownershipTokenId";
-    // file deepcode ignore NonCryptoHardcodedSecret/test: <please specify a reason of ignoring this>
-    public final static String API_KEY = (env.get("apiKey") != null) ? env.get("apiKey") : "apiKey99999999";
+    public final static String API_KEY = (env.get("apiKey") != null) ? env.get("apiKey")
+            : "blt" + UUID.randomUUID().toString().replace("-", "").substring(0, 16);
     public final static String MANAGEMENT_TOKEN = (env.get("managementToken") != null) ? env.get("managementToken")
             : "managementToken99999999";
 
diff --git a/src/test/java/com/contentstack/cms/models/LoginDetailTest.java b/src/test/java/com/contentstack/cms/models/LoginDetailTest.java
index 5e070556..73769a7d 100644
--- a/src/test/java/com/contentstack/cms/models/LoginDetailTest.java
+++ b/src/test/java/com/contentstack/cms/models/LoginDetailTest.java
@@ -1,5 +1,6 @@
 package com.contentstack.cms.models;
 
+import java.util.UUID;
 import com.contentstack.cms.core.AuthInterceptor;
 import okhttp3.Interceptor;
 import okhttp3.internal.http.RealInterceptorChain;
@@ -102,9 +103,9 @@ void getterSetterUserModelLastName() {
     @Test
     void getterSetterUserModelUsername() {
         UserModel userModel = new UserModel();
-        // deepcode ignore NoHardcodedCredentials/test: <please specify a reason of ignoring this>
-        userModel.setUsername("***REMOVED***");
-        Assertions.assertEquals("***REMOVED***",
+        String username = UUID.randomUUID().toString();
+        userModel.setUsername(username);
+        Assertions.assertEquals(username,
                 userModel.getUsername());
     }