diff --git a/backend/controllers/wechatcallback/page.go b/backend/controllers/wechatcallback/page.go
index 8599eb4b..e0d30bed 100644
--- a/backend/controllers/wechatcallback/page.go
+++ b/backend/controllers/wechatcallback/page.go
@@ -40,7 +40,8 @@ func Write(w http.ResponseWriter, authorized bool) {
 	data := struct {
 		Authorized bool
 		CSS        template.CSS
-	}{authorized, template.CSS(pageCSS)} // 仅信任编译时内嵌样式，禁止传入请求内容。
+	// #nosec G203 -- pageCSS 为编译时内嵌常量，不受用户输入控制，不存在 XSS 风险
+	}{authorized, template.CSS(pageCSS)}
 	if err := resultTemplate.Execute(&body, data); err != nil {
 		http.Error(w, "页面暂时无法显示，请返回 Smail 查看绑定状态。", http.StatusInternalServerError)
 		return
diff --git a/backend/listen/smtp_server/read_content.go b/backend/listen/smtp_server/read_content.go
index 14bffc25..4daf22fc 100644
--- a/backend/listen/smtp_server/read_content.go
+++ b/backend/listen/smtp_server/read_content.go
@@ -365,7 +365,9 @@ func saveEmail(ctx *context.Context, size int, email *parsemail.Email, sendUserI
 		}
 		session := db.Instance.NewSession()
 		blocked, filterErr := models.BlacklistedRecipientIDs(session, userIDs, email.SenderFilterAddresses()...)
-		session.Close()
+		if closeErr := session.Close(); closeErr != nil && filterErr == nil {
+			filterErr = closeErr
+		}
 		if filterErr != nil {
 			return nil, nil, filterErr
 		}
diff --git a/backend/services/detail/detail.go b/backend/services/detail/detail.go
index f1604bee..1577fea0 100644
--- a/backend/services/detail/detail.go
+++ b/backend/services/detail/detail.go
@@ -50,7 +50,9 @@ func GetEmailDetail(ctx *context.Context, id int, markRead bool) (*response.Emai
 	}
 	session := db.Instance.NewSession()
 	blocked, err := models.BlacklistedRecipientIDs(session, []int{ctx.UserID}, email.FromAddress, sender.EmailAddress)
-	session.Close()
+	if closeErr := session.Close(); closeErr != nil && err == nil {
+		err = closeErr
+	}
 	if err != nil {
 		return nil, err
 	}
diff --git a/backend/services/rule/rule.go b/backend/services/rule/rule.go
index d7f5c54f..b2950d73 100644
--- a/backend/services/rule/rule.go
+++ b/backend/services/rule/rule.go
@@ -171,7 +171,9 @@ func forwardToLocalUser(ctx *context.Context, email *parsemail.Email, account, f
 	}
 	session := db.Instance.NewSession()
 	blocked, filterErr := models.BlacklistedRecipientIDs(session, []int{user.ID}, email.SenderFilterAddresses()...)
-	session.Close()
+	if closeErr := session.Close(); closeErr != nil && filterErr == nil {
+		filterErr = closeErr
+	}
 	if filterErr != nil {
 		return filterErr
 	}
diff --git a/backend/services/verification/store.go b/backend/services/verification/store.go
index 50600a06..d8dbb0c0 100644
--- a/backend/services/verification/store.go
+++ b/backend/services/verification/store.go
@@ -382,7 +382,9 @@ func randomCodeFromReader(length int, reader io.Reader) (string, error) {
 					continue
 				}
 				digit := int(value) % len(digits)
+				// #nosec G602 -- digit 取值由 int(value)%len(digits) 限定在 0-9 范围，且 counts 和 digits 长度均固定为 10，不存在切片越界
 				code[written] = digits[digit]
+				// #nosec G602 -- digit 取值限定在 0-9 范围，counts 长度为 10，不存在切片越界
 				counts[digit]++
 				written++
 				if written == length {
diff --git a/backend/utils/credential/egress.go b/backend/utils/credential/egress.go
index f3c38e01..2ba3c303 100644
--- a/backend/utils/credential/egress.go
+++ b/backend/utils/credential/egress.go
@@ -16,6 +16,7 @@ import (
 
 const (
 	PluginEgressSocket           = "/egress.socket"
+	// #nosec G101 -- 这是 HTTP 请求头名称常量，并非硬编码密码凭证
 	egressTokenHeader            = "X-Smail-Egress-Token"
 	egressTargetHeader           = "X-Smail-Egress-Target"
 	maxEgressRequestBytes  int64 = 32 << 20