diff --git a/cmd/dashboard/controller/api_token.go b/cmd/dashboard/controller/api_token.go
index d4da43b3..edb36f3a 100644
--- a/cmd/dashboard/controller/api_token.go
+++ b/cmd/dashboard/controller/api_token.go
@@ -18,8 +18,8 @@ import (
 
 const (
 	apiTokenSecretLength    = 32                          // 明文 token 随机部分长度（hex 编码前）
-	apiTokenCtxKey          = "nz_api_token"              // gin context 里存 *model.APIToken 的 key
-	apiTokenLastUsedCtxKey  = "nz_api_token_used_marker"  // 标记是否需要异步更新 last_used
+	apiTokenCtxKey          = "nz_api_token"              // #nosec G101 -- gin context key name, not a credential
+	apiTokenLastUsedCtxKey  = "nz_api_token_used_marker"  // #nosec G101 -- gin context key name, not a credential
 	apiTokenAuthSchemePrefix = "Bearer "
 )
 
diff --git a/model/api_token.go b/model/api_token.go
index 030052b7..18e7be94 100644
--- a/model/api_token.go
+++ b/model/api_token.go
@@ -64,7 +64,7 @@ const (
 	ScopeNotificationDelete = "nezha:notification:delete"
 
 	ScopeNotificationGroupRead   = "nezha:notification-group:read"
-	ScopeNotificationGroupWrite  = "nezha:notification-group:write"
+	ScopeNotificationGroupWrite  = "nezha:notification-group:write" // #nosec G101 -- scope identifier, not a credential
 	ScopeNotificationGroupDelete = "nezha:notification-group:delete"
 
 	ScopeTransferRead   = "nezha:transfer:read"