diff --git a/src/pygira/baresip_monitor.py b/src/pygira/baresip_monitor.py
index bf287ad..e9f5729 100644
--- a/src/pygira/baresip_monitor.py
+++ b/src/pygira/baresip_monitor.py
@@ -206,7 +206,8 @@ def _write_config(
         # It is mode 0600 inside a mode-0700 temporary directory, is never logged or
         # passed as a process argument, and is unlinked immediately after startup.
         account = _account_parameter(self.host, self.username, self._password)
-        # codeql[py/clear-text-storage-sensitive-data]
+        # lgtm [py/clear-text-storage-sensitive-data]: Baresip requires this
+        # short-lived 0600 file; the temporary directory is removed on close.
         accounts_path.write_text(account + "\n", encoding="utf-8")
         accounts_path.chmod(_CONFIG_MODE)
         return accounts_path