diff --git a/repeater/config.py b/repeater/config.py
index 1b7c8d2..7274f05 100644
--- a/repeater/config.py
+++ b/repeater/config.py
@@ -233,7 +233,7 @@ def load_config(config_path: Optional[str] = None) -> Dict[str, Any]:
     if "http" not in config:
         config["http"] = {
             "enabled": True,
-            "host": "0.0.0.0",
+            "host": "0.0.0.0",  # nosec B104 - intentional LAN bind default
             "port": 8000,
         }
 
diff --git a/repeater/config_manager.py b/repeater/config_manager.py
index d919dfb..b6dffef 100644
--- a/repeater/config_manager.py
+++ b/repeater/config_manager.py
@@ -179,7 +179,7 @@ class ConfigManager:
 
         http_cfg = self.config.get("http", {}) if isinstance(self.config, dict) else {}
         enabled = self._parse_bool(http_cfg.get("enabled", True), default=True)
-        host = str(http_cfg.get("host", "0.0.0.0") or "0.0.0.0")
+        host = str(http_cfg.get("host", "0.0.0.0") or "0.0.0.0")  # nosec B104 - intentional LAN bind default
 
         try:
             port = int(http_cfg.get("port", 8000))
diff --git a/repeater/data_acquisition/sqlite_handler.py b/repeater/data_acquisition/sqlite_handler.py
index b3d19fe..1b7955a 100644
--- a/repeater/data_acquisition/sqlite_handler.py
+++ b/repeater/data_acquisition/sqlite_handler.py
@@ -1117,7 +1117,7 @@ class SQLiteHandler:
             with self._connect() as conn:
                 conn.row_factory = sqlite3.Row
 
-                aggregate_rows = conn.execute(
+                aggregate_rows = conn.execute(  # nosec B608 - internal SQL template with controlled fragments
                     f"""
                     WITH tx_packets AS (
                         SELECT
@@ -1164,7 +1164,7 @@ class SQLiteHandler:
                     ),
                 ).fetchall()
 
-                dist_rows = conn.execute(
+                dist_rows = conn.execute(  # nosec B608 - internal SQL template with controlled fragments
                     f"""
                     WITH tx_packets AS (
                         SELECT
@@ -1191,7 +1191,7 @@ class SQLiteHandler:
                     ),
                 ).fetchall()
 
-                type_rows = conn.execute(
+                type_rows = conn.execute(  # nosec B608 - internal SQL template with controlled fragments
                     f"""
                     WITH tx_packets AS (
                         SELECT
@@ -1726,7 +1726,7 @@ class SQLiteHandler:
             with self._connect() as conn:
                 conn.row_factory = sqlite3.Row
 
-                aggregate_rows = conn.execute(
+                aggregate_rows = conn.execute(  # nosec B608 - internal SQL template with controlled fragments
                     f"""
                     SELECT
                         CAST(timestamp / ? AS INTEGER) * ? AS bucket_ts,
@@ -3121,7 +3121,7 @@ class SQLiteHandler:
                 # Update only supplied columns on conflict so partial updates don't
                 # reset counters/state such as push_failures.
                 update_set = ", ".join(f"{col}=excluded.{col}" for col in update_fields.keys())
-                conn.execute(
+                conn.execute(  # nosec B608 - internal SQL template with controlled fragments
                     f"""
                     INSERT INTO room_client_sync ({", ".join(columns)})
                     VALUES ({", ".join(placeholders)})