diff --git a/.github/workflows/deploy-smoke-test.yml b/.github/workflows/deploy-smoke-test.yml
index 30806f1442..48f3091498 100644
--- a/.github/workflows/deploy-smoke-test.yml
+++ b/.github/workflows/deploy-smoke-test.yml
@@ -70,6 +70,7 @@ jobs:
 
     services:
       mongo:
+        # pre-commit-checker: not a secret — sha256 image digest pin for supply-chain integrity, not a credential
         image: mongo:7@sha256:43fddee7e532a920f3dfdee9e8f4834398c155c26bcb92d790cc1cd3c630fc40 # mongo:7
         ports:
           - 27017:27017
@@ -104,6 +105,7 @@ jobs:
         run: |
           set -euo pipefail
           GUM_VERSION=0.14.5
+          # pre-commit-checker: not a secret — publisher-published sha256 checksum for the gum release tarball
           EXPECTED_SHA256=fd1a34711ae724eb2a6c1a3209d57078d529575a03316e699054f2f5d3bcb2ba
           curl -fsSLo /tmp/gum.deb "https://github.com/charmbracelet/gum/releases/download/v${GUM_VERSION}/gum_${GUM_VERSION}_amd64.deb"
           echo "${EXPECTED_SHA256}  /tmp/gum.deb" | sha256sum -c -
diff --git a/script/demoScripts/demoPatcher.ts b/script/demoScripts/demoPatcher.ts
index bcfb6cba5d..145871ab89 100644
--- a/script/demoScripts/demoPatcher.ts
+++ b/script/demoScripts/demoPatcher.ts
@@ -45,6 +45,7 @@ const ERC20_ABI = erc20Artifact.abi
  * Execute CowSwap demo with Patcher contract
  *
  * Example successful transaction:
+ * pre-commit-checker: not a secret — public on-chain example transaction hash, not a credential
  * - Arbitrum: https://arbiscan.io/tx/0x7536cd0d5175a6a985f6a0c5cbfaf63b573fe2300301c57e12cca4c8995fe891
  */
 async function executeCowSwapDemo(options: {
@@ -96,6 +97,7 @@ async function executeCowSwapDemo(options: {
       const approveTx = await wethContract.write?.approve?.([
         VAULT_RELAYER_ARBITRUM as `0x${string}`,
         BigInt(
+          // pre-commit-checker: not a secret — max uint256 constant, not a private key
           '0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
         ), // Max uint256
       ])
diff --git a/script/demoScripts/utils/cowSwapHelpers.ts b/script/demoScripts/utils/cowSwapHelpers.ts
index 3369f10455..847315ba29 100644
--- a/script/demoScripts/utils/cowSwapHelpers.ts
+++ b/script/demoScripts/utils/cowSwapHelpers.ts
@@ -271,6 +271,7 @@ export async function setupCowShedPostHooks(config: ICowShedPostHooksConfig) {
   const relayData = {
     requestId: relayRequestId,
     nonEVMReceiver:
+      // pre-commit-checker: not a secret — zero bytes32 sentinel (non-EVM bridging disabled)
       '0x0000000000000000000000000000000000000000000000000000000000000000' as `0x${string}`, // Not bridging to non-EVM chain
     receivingAssetId: pad(baseUsdcAddress as `0x${string}`), // Use viem's pad instead of manual padStart
     signature: relaySignature, // Real signature from the Relay API
@@ -350,6 +351,7 @@ export async function setupCowShedPostHooks(config: ICowShedPostHooksConfig) {
     args: [
       lifiDiamondAddress as `0x${string}`, // spender - LiFi Diamond
       BigInt(
+        // pre-commit-checker: not a secret — max uint256 constant, not a private key
         '0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
       ), // Max uint256 approval
     ],
diff --git a/script/deploy/safe/timelock-queue.test.ts b/script/deploy/safe/timelock-queue.test.ts
index b37132180b..3ba0d4f45b 100644
--- a/script/deploy/safe/timelock-queue.test.ts
+++ b/script/deploy/safe/timelock-queue.test.ts
@@ -18,6 +18,7 @@ import {
 } from './timelock-queue'
 
 const ZERO_BYTES32 =
+  // pre-commit-checker: not a secret — zero bytes32 sentinel used as test fixture
   '0x0000000000000000000000000000000000000000000000000000000000000000' as Hex
 
 const SAMPLE_TARGET = '0x1231DEB6f5749EF6cE6943a275A1D3E7486F4EaE' as Address
diff --git a/test/solidity/Periphery/Patcher.t.sol b/test/solidity/Periphery/Patcher.t.sol
index 8a6a6a01fa..0ed3be068a 100644
--- a/test/solidity/Periphery/Patcher.t.sol
+++ b/test/solidity/Periphery/Patcher.t.sol
@@ -1739,6 +1739,7 @@ contract PatcherTest is TestBase {
         );
 
         bridgeData
+        // pre-commit-checker: not a secret — fixed test fixture marker used to locate the patched word
             .minAmount = 0x1234567890ABCDEF1234567890ABCDEF1234567890ABCDEF1234567890ABCDEF;
         bytes memory calldataWithMarker = abi.encodeWithSelector(
             relayDepositoryFacet.startBridgeTokensViaRelayDepository.selector,
@@ -1827,6 +1828,7 @@ contract PatcherTest is TestBase {
         );
 
         bridgeData
+        // pre-commit-checker: not a secret — fixed test fixture marker used to locate the patched word
             .minAmount = 0x1234567890ABCDEF1234567890ABCDEF1234567890ABCDEF1234567890ABCDEF;
         bytes memory calldataWithMarker = abi.encodeWithSelector(
             relayDepositoryFacet.startBridgeTokensViaRelayDepository.selector,
@@ -1912,6 +1914,7 @@ contract PatcherTest is TestBase {
         );
 
         bridgeData
+        // pre-commit-checker: not a secret — fixed test fixture marker used to locate the patched word
             .minAmount = 0x1234567890ABCDEF1234567890ABCDEF1234567890ABCDEF1234567890ABCDEF;
         bytes memory calldataWithMarker = abi.encodeWithSelector(
             relayDepositoryFacet.startBridgeTokensViaRelayDepository.selector,