diff --git a/.github/workflows/build-publish.yml b/.github/workflows/build-publish.yml
index 8bc01bf..5862bf8 100644
--- a/.github/workflows/build-publish.yml
+++ b/.github/workflows/build-publish.yml
@@ -79,7 +79,7 @@ jobs:
       contents: read
     # The App key is a secret of the `release` environment; environment
     # secrets reach a reusable workflow only through `secrets: inherit`.
-    secrets: inherit # zizmor: ignore[secrets-inherit]
+    secrets: inherit # zizmor: ignore[secrets-inherit] # nosemgrep: yaml.github-actions.security.secrets-inherit.secrets-inherit
     with:
       version-file: package.json
       tag-prefix: ""
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 12503cb..a04023f 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -2,9 +2,10 @@
 # dependencies (osv-scanner on package-lock.json), semgrep, configuration and
 # licences.
 #
-# Report-only for now (fail-on empty): the report job lists every finding;
-# blocking follows once they are fixed. Accepted findings go into
-# .trivyignore.yaml / security/vex.openvex.json / .gitleaks.toml with a reason.
+# Blocking: a secret, a critical or high vulnerability with a fix, a high
+# misconfiguration, a forbidden licence or a semgrep error fails the check.
+# Accepted findings go into .trivyignore.yaml / security/vex.openvex.json /
+# .gitleaks.toml with a reason and an expiry date.
 name: security
 
 on:
@@ -30,4 +31,4 @@ jobs:
       security-events: write
     with:
       languages: node
-      fail-on: ""
+      fail-on: secrets,vuln-critical,vuln-high,misconfig-high,license-forbidden,semgrep-error
diff --git a/src/widget-mapbox.ts b/src/widget-mapbox.ts
index bec114b..24b1422 100644
--- a/src/widget-mapbox.ts
+++ b/src/widget-mapbox.ts
@@ -51,6 +51,7 @@ type AppliedLayers = {
 // Fallback only: the IronFlock UI passes the token for its environment through `accessToken`.
 // This production token is URL-restricted to studio.ironflock.com.
 const DEFAULT_ACCESS_TOKEN =
+    // nosemgrep: generic.secrets.security.detected-jwt-token.detected-jwt-token -- a public Mapbox token (pk.), sent to every browser
     'pk.eyJ1IjoibWFya29wZSIsImEiOiJjbXB2Yjh2ankwMWUxMnNyM243aGFlNGxiIn0.BXax9rCajgo3Sn5MvAu7dQ'
 const DEFAULT_STYLE = 'light-v11'
 const LAYER_TYPES: LayerType[] = ['circle', 'symbol', 'heatmap', 'line']