diff --git a/.flake8 b/.flake8
index b353c07..5a5abd8 100644
--- a/.flake8
+++ b/.flake8
@@ -3,4 +3,5 @@ max-line-length = 120
 # E221: multiple spaces before operator — intentional column alignment
 # E305: two blank lines after function — relaxed for module-level code
 extend-ignore = E221, E305
-exclude = __pycache__, .git
+exclude = __pycache__, .git, node_modules
+extend-exclude = node_modules
diff --git a/app.py b/app.py
index 49ccbdc..b1c0ebe 100644
--- a/app.py
+++ b/app.py
@@ -31,9 +31,10 @@ app = Flask(__name__)
 
 _AVATAR_COLORS = ['lt-avatar--orange', 'lt-avatar--green', 'lt-avatar--purple', '']
 
+
 @app.template_filter('avatar_color')
 def avatar_color_filter(name: str) -> str:
-    return _AVATAR_COLORS[int(hashlib.md5(name.encode()).hexdigest(), 16) % len(_AVATAR_COLORS)]
+    return _AVATAR_COLORS[int(hashlib.md5(name.encode()).hexdigest(), 16) % len(_AVATAR_COLORS)]  # nosec B324
 
 _cfg = None
 _cfg_lock = threading.Lock()
@@ -57,8 +58,6 @@ _diag_jobs: dict = {}
 _diag_lock = threading.Lock()
 
 
-
-
 def _purge_old_jobs_loop():
     """Background thread: remove stale diag jobs and run daily event purge."""
     while True:
@@ -479,4 +478,4 @@ def health():
 
 
 if __name__ == '__main__':
-    app.run(debug=True, host='0.0.0.0', port=5000)  # nosec B201 — dev runner only; production uses gunicorn
+    app.run(debug=True, host='0.0.0.0', port=5000)  # nosec B201 B104 — dev runner only; production uses gunicorn