diff --git a/build/credscan-exclude.json b/build/credscan-exclude.json
new file mode 100644
index 00000000..9f90dfe0
--- /dev/null
+++ b/build/credscan-exclude.json
@@ -0,0 +1,17 @@
+{
+  "tool": "Credential Scanner",
+  "suppressions": [
+    {
+      "file": "test-certificate.pfx",
+      "_justification": "test self signed certificate to test signing from the library. this certificate is not associated with any tenant"
+    },
+    {
+      "placeholder": "client_secret",
+      "_justification" : "credential used for testing. not associated with any tenant"
+    },
+    {
+      "placeholder": "ClientPassword",
+      "_justification" : "credential used for testing. not associated with any tenant"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/build/findbugs-exclude.xml b/build/findbugs-exclude.xml
new file mode 100644
index 00000000..b72f7cfd
--- /dev/null
+++ b/build/findbugs-exclude.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FindBugsFilter>
+    <!-- Experimental and not fully vetted bug patterns -->
+    <Match>
+        <Bug pattern="CRLF_INJECTION_LOGS"/>
+    </Match>
+    <Match>
+        <Bug pattern="XXE_DOCUMENT"/>
+    </Match>
+    <Match>
+        <Bug pattern="XPATH_INJECTION"/>
+    </Match>
+    <Match>
+        <Bug pattern="FORMAT_STRING_MANIPULATION"/>
+    </Match>
+    <Match>
+        <Bug pattern="WEAK_MESSAGE_DIGEST_SHA1"/>
+    </Match>
+    <Match>
+        <Bug pattern="DM_DEFAULT_ENCODING"/>
+    </Match>
+    <Match>
+        <Bug pattern="DM_CONVERT_CASE"/>
+    </Match>
+    <Match>
+        <Bug pattern="REC_CATCH_EXCEPTION"/>
+    </Match>
+</FindBugsFilter>
\ No newline at end of file