diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index ab8e927..feee21a 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -125,7 +125,7 @@ jobs:
           fetch-depth: 0
       - name: Run gitleaks
         run: |
-          apt-get update && apt-get install -y --no-install-recommends wget ca-certificates && rm -rf /var/lib/apt/lists/*
+          apt-get update && apt-get install -y --no-install-recommends wget git ca-certificates && rm -rf /var/lib/apt/lists/*
           wget -qO- https://github.com/gitleaks/gitleaks/releases/download/v8.24.0/gitleaks_8.24.0_linux_x64.tar.gz | tar -xz -C /usr/local/bin gitleaks
           gitleaks detect --source . --redact --no-banner
 
diff --git a/advanced.py b/advanced.py
index db0aca6..a3d49c6 100644
--- a/advanced.py
+++ b/advanced.py
@@ -56,7 +56,7 @@ class PryAdvanced:
     async def track_diff(self, url: str, new_content: str) -> dict:
         """Compare current content against previous scrape. Returns unified diff.
         First scrape returns 'initial', subsequent returns changes."""
-        content_hash = hashlib.md5(new_content.encode()).hexdigest()
+        content_hash = hashlib.md5(new_content.encode(), usedforsecurity=False).hexdigest()
 
         if url not in self._diffs:
             self._diffs[url] = [
diff --git a/cache.py b/cache.py
index 3971193..35f1cd5 100644
--- a/cache.py
+++ b/cache.py
@@ -31,7 +31,7 @@ class ResponseCache:
         """Generate cache key from URL + options."""
         opt_str = json.dumps(options or {}, sort_keys=True)
         raw = f"{url}:{opt_str}"
-        return hashlib.md5(raw.encode()).hexdigest()
+        return hashlib.md5(raw.encode(), usedforsecurity=False).hexdigest()
 
     def get(self, url: str, options: dict | None = None) -> dict | None:
         """Get cached response if fresh."""
diff --git a/cli.py b/cli.py
index a44943d..b544bcb 100755
--- a/cli.py
+++ b/cli.py
@@ -214,7 +214,7 @@ def cmd_run(pryfile_path="pry.yml"):
             print(f"  {RED}✖{NC} {name} — {j.get('error', 'failed')}{NC}")
 
 
-def cmd_serve(host="0.0.0.0", port=8005):
+def cmd_serve(host="0.0.0.0", port=8005):  # nosec B104
     """Start the Pry API server."""
     print(f"{CYAN}🔧 Starting Pry v{VERSION} on {host}:{port}{NC}")
     print(f"  Dashboard: http://localhost:{port}/dashboard")
diff --git a/config.py b/config.py
index f979598..236a270 100644
--- a/config.py
+++ b/config.py
@@ -65,7 +65,7 @@ class Settings(BaseSettings):
     mcp_tools_count: int = 8
 
     # Storage
-    screenshot_dir: Path = Path("/tmp/pry-screenshots")
+    screenshot_dir: Path = Path("/tmp/pry-screenshots")  # nosec B108
     cache_ttl_seconds: int = 3600
 
 
diff --git a/dedup.py b/dedup.py
index 0710d95..5e201ba 100644
--- a/dedup.py
+++ b/dedup.py
@@ -27,7 +27,7 @@ class SimHash:
             return 0
         vector = [0] * n_features
         for token in tokens:
-            token_hash = int(hashlib.md5(token.encode()).hexdigest(), 16)
+            token_hash = int(hashlib.md5(token.encode(), usedforsecurity=False).hexdigest(), 16)
             for i in range(n_features):
                 if token_hash & (1 << i):
                     vector[i] += 1
diff --git a/pdf_extractor.py b/pdf_extractor.py
index a63b446..8dea257 100644
--- a/pdf_extractor.py
+++ b/pdf_extractor.py
@@ -111,7 +111,7 @@ class PDFTableExtractor:
         import camelot
 
         tables: list[dict[str, Any]] = []
-        tmp_path = "/tmp/_pry_pdf.pdf"
+        tmp_path = "/tmp/_pry_pdf.pdf"  # nosec B108
         try:
             with open(tmp_path, "wb") as f:
                 f.write(pdf_bytes)
diff --git a/pryextras.py b/pryextras.py
index e2d8c05..56657e3 100644
--- a/pryextras.py
+++ b/pryextras.py
@@ -143,7 +143,7 @@ class TransformEngine:
                 values.append(str(v))
         cols = ", ".join(columns)
         vals = ", ".join(values)
-        return f"INSERT INTO {table} ({cols}) VALUES ({vals});"
+        return f"INSERT INTO {table} ({cols}) VALUES ({vals});"  # nosec B608
 
     @staticmethod
     def to_csv(data: list[dict]) -> str:
diff --git a/settings.py b/settings.py
index 935100a..e4ed772 100644
--- a/settings.py
+++ b/settings.py
@@ -21,7 +21,7 @@ class PrySettings(BaseSettings):
 
     # Core
     url: str = "http://localhost:8002"
-    host: str = "0.0.0.0"
+    host: str = "0.0.0.0"  # nosec B104
     port: int = 8002
 
     # Ollama LLM endpoint