diff --git a/src/govoplan_campaign/backend/campaign/models.py b/src/govoplan_campaign/backend/campaign/models.py
index f2ace24..9797417 100644
--- a/src/govoplan_campaign/backend/campaign/models.py
+++ b/src/govoplan_campaign/backend/campaign/models.py
@@ -31,7 +31,7 @@ class FieldType(StrEnum):
     INTEGER = "integer"
     DOUBLE = "double"
     DATE = "date"
-    PASSWORD = "password"
+    PASSWORD = "password"  # noqa: S105  # nosec B105 - field type vocabulary.
 
 
 class RecipientType(StrEnum):
diff --git a/src/govoplan_campaign/backend/reports/campaigns.py b/src/govoplan_campaign/backend/reports/campaigns.py
index 7e0657c..b7de0fb 100644
--- a/src/govoplan_campaign/backend/reports/campaigns.py
+++ b/src/govoplan_campaign/backend/reports/campaigns.py
@@ -81,7 +81,7 @@ def _load_delivery_info(version: CampaignVersion | None, jobs: list[CampaignJob]
         "execution_snapshot_hash": None,
         "execution_snapshot_at": None,
         "snapshot_version": None,
-        "build_token": None,
+        "build_token": None,  # nosec B105 - absent report value, not a credential.
         "built_at": None,
         "job_manifest_sha256": None,
         "job_count": 0,
diff --git a/src/govoplan_campaign/backend/services/zip_service.py b/src/govoplan_campaign/backend/services/zip_service.py
index df81b02..41d06d6 100644
--- a/src/govoplan_campaign/backend/services/zip_service.py
+++ b/src/govoplan_campaign/backend/services/zip_service.py
@@ -41,7 +41,7 @@ def _normalized_members(files: Iterable[Path | ArchiveMember]) -> list[ArchiveMe
 def create_zip_archive(
     output_path: Path,
     files: Iterable[Path | ArchiveMember],
-    password: str = "",
+    password: str = "",  # nosec B107 - empty means an unencrypted archive.
     method: str = ZIP_METHOD_AES,
 ) -> Path:
     """Create a ZIP archive, optionally using AES or legacy ZipCrypto encryption."""
diff --git a/tests/test_access_provider.py b/tests/test_access_provider.py
index 6dd0def..724fa0d 100644
--- a/tests/test_access_provider.py
+++ b/tests/test_access_provider.py
@@ -21,6 +21,7 @@ GROUP_ID = "group-1"
 class CampaignAccessProviderTests(unittest.TestCase):
     def test_campaign_access_provider_explains_owner_share_admin_and_missing_resources(self) -> None:
         session = _session()
+        self.addCleanup(_close_session, session)
         _seed_access_subjects(session)
         owned = Campaign(id="campaign-owned", tenant_id=TENANT_ID, owner_user_id=USER_ID, external_id="owned", name="Owned campaign")
         shared = Campaign(id="campaign-shared", tenant_id=TENANT_ID, owner_user_id=OTHER_USER_ID, external_id="shared", name="Shared campaign")
@@ -46,6 +47,7 @@ class CampaignAccessProviderTests(unittest.TestCase):
 
     def test_campaign_access_provider_requires_write_share_for_write_actions(self) -> None:
         session = _session()
+        self.addCleanup(_close_session, session)
         _seed_access_subjects(session)
         campaign = Campaign(id="campaign-write", tenant_id=TENANT_ID, owner_user_id=OTHER_USER_ID, external_id="write", name="Write campaign")
         session.add_all([
@@ -74,6 +76,12 @@ def _session():
     return sessionmaker(bind=engine, future=True)()
 
 
+def _close_session(session) -> None:
+    engine = session.get_bind()
+    session.close()
+    engine.dispose()
+
+
 def _seed_access_subjects(session) -> None:
     session.add_all([
         Account(id="account-1", email="one@example.test", normalized_email="one@example.test"),