diff --git a/src/govoplan_mail/backend/documentation.py b/src/govoplan_mail/backend/documentation.py
index cc11f86..efd4215 100644
--- a/src/govoplan_mail/backend/documentation.py
+++ b/src/govoplan_mail/backend/documentation.py
@@ -15,8 +15,9 @@ MAIL_POLICY_DOC_SCOPES = ("mail:profile:read", "admin:policies:read", "system:se
 MAIL_PROFILE_READ_SCOPE = "mail:profile:read"
 MAIL_PROFILE_WRITE_SCOPE = "mail:profile:write"
 MAIL_PROFILE_WRITE_OWN_SCOPE = "mail:profile:write_own"
-MAIL_SECRET_MANAGE_SCOPE = "mail:secret:manage"  # noqa: S105 -- permission identifier, not a credential
-MAIL_SECRET_MANAGE_OWN_SCOPE = "mail:secret:manage_own"  # noqa: S105 -- permission identifier, not a credential
+# RBAC permission identifiers; neither value is a stored credential.
+MAIL_SECRET_MANAGE_SCOPE = "mail:secret:manage"  # noqa: S105  # nosec B105
+MAIL_SECRET_MANAGE_OWN_SCOPE = "mail:secret:manage_own"  # noqa: S105  # nosec B105
 MAIL_PROFILE_TEST_SCOPE = "mail:profile:test"
 MAIL_PROFILE_USE_SCOPE = "mail:profile:use"
 _HOST_POLICY_FIELDS = (("SMTP", "smtp_hosts"), ("IMAP", "imap_hosts"))