diff --git a/application/sandbox/jupyter_gateway.py b/application/sandbox/jupyter_gateway.py
index 9e7add1d..f055a7ea 100644
--- a/application/sandbox/jupyter_gateway.py
+++ b/application/sandbox/jupyter_gateway.py
@@ -25,7 +25,7 @@ logger = logging.getLogger(__name__)
 
 # Per-session workspace root inside the runner container. The kernel sets its
 # cwd here so relative paths from LLM code and file in/out share one directory.
-_WORKSPACE_ROOT = "/tmp/docsgpt-sandbox"
+_WORKSPACE_ROOT = "/tmp/docsgpt-sandbox"  # nosec B108 - controlled per-session sandbox workspace dir
 
 # Marker the get_file helper prints around the base64 payload so we can extract
 # it from interleaved stdout without a contents API (the gateway has none).
diff --git a/tests/agents/test_workflow_input_documents.py b/tests/agents/test_workflow_input_documents.py
index bbc4b3ea..c6c2cac0 100644
--- a/tests/agents/test_workflow_input_documents.py
+++ b/tests/agents/test_workflow_input_documents.py
@@ -177,7 +177,8 @@ def test_attachments_bridge_to_run_scoped_artifacts(pg_engine, tmp_path, monkeyp
     # The bytes round-trip from storage (never entered state).
     with pg_engine.connect() as conn:
         v = ArtifactsRepository(conn).get_version(refs[0]["artifact_id"], 1)
-    assert storage.get_file(v["storage_path"]).read() == a1
+    with storage.get_file(v["storage_path"]) as fh:
+        assert fh.read() == a1
 
 
 def test_attachments_capped_per_run(pg_engine, tmp_path, monkeypatch):
diff --git a/tests/api/user/test_artifacts_routes.py b/tests/api/user/test_artifacts_routes.py
index c2641857..f65725e4 100644
--- a/tests/api/user/test_artifacts_routes.py
+++ b/tests/api/user/test_artifacts_routes.py
@@ -486,7 +486,7 @@ class TestMalformedArtifactId:
         self, _patch_db, flask_app, token_owner, resource_name,
         extra_args, method, json_body,
     ):
-        import application.api.user.artifacts.routes as routes_mod
+        from application.api.user.artifacts import routes as routes_mod
 
         resource_cls = getattr(routes_mod, resource_name)
         resp = _call(
diff --git a/tests/sandbox/test_sandbox_manager.py b/tests/sandbox/test_sandbox_manager.py
index 577227d9..ce30636e 100644
--- a/tests/sandbox/test_sandbox_manager.py
+++ b/tests/sandbox/test_sandbox_manager.py
@@ -385,6 +385,7 @@ def test_concurrent_open_close_stays_consistent(backend):
                     mgr.open(sid)
                     mgr.exec(sid, "x")
                 except SandboxCapacityError:
+                    # capacity is expected under churn; skip this session
                     pass
                 mgr.reap_expired()
                 mgr.close(sid)