diff --git a/cmd/bd/compact.go b/cmd/bd/compact.go
index c251c1d6..72e4c391 100644
--- a/cmd/bd/compact.go
+++ b/cmd/bd/compact.go
@@ -1019,7 +1019,7 @@ func pruneExpiredTombstones() (*TombstonePruneResult, error) {
 		}
 		allIssues = append(allIssues, &issue)
 	}
-	file.Close()
+	_ = file.Close() // Best effort close, already read all data
 
 	// Determine TTL
 	ttl := types.DefaultTombstoneTTL
@@ -1052,20 +1052,20 @@ func pruneExpiredTombstones() (*TombstonePruneResult, error) {
 	encoder := json.NewEncoder(tempFile)
 	for _, issue := range kept {
 		if err := encoder.Encode(issue); err != nil {
-			tempFile.Close()
-			os.Remove(tempPath)
+			_ = tempFile.Close()
+			_ = os.Remove(tempPath) // Best effort cleanup
 			return nil, fmt.Errorf("failed to write issue %s: %w", issue.ID, err)
 		}
 	}
 
 	if err := tempFile.Close(); err != nil {
-		os.Remove(tempPath)
+		_ = os.Remove(tempPath) // Best effort cleanup
 		return nil, fmt.Errorf("failed to close temp file: %w", err)
 	}
 
 	// Atomically replace
 	if err := os.Rename(tempPath, issuesPath); err != nil {
-		os.Remove(tempPath)
+		_ = os.Remove(tempPath) // Best effort cleanup
 		return nil, fmt.Errorf("failed to replace issues.jsonl: %w", err)
 	}
 
diff --git a/cmd/bd/migrate_tombstones.go b/cmd/bd/migrate_tombstones.go
index 5162fa3a..6ba939d6 100644
--- a/cmd/bd/migrate_tombstones.go
+++ b/cmd/bd/migrate_tombstones.go
@@ -128,7 +128,7 @@ Examples:
 					existingTombstones[issue.ID] = true
 				}
 			}
-			file.Close()
+			_ = file.Close()
 		}
 
 		// Determine which deletions need migration
diff --git a/cmd/bd/reset.go b/cmd/bd/reset.go
index d33c0951..69aea677 100644
--- a/cmd/bd/reset.go
+++ b/cmd/bd/reset.go
@@ -139,7 +139,7 @@ EXAMPLES:
 
 			response = strings.TrimSpace(strings.ToLower(response))
 			if response != "y" && response != "yes" {
-				fmt.Printf("Reset cancelled.\n")
+				fmt.Printf("Reset canceled.\n")
 				return
 			}
 		}
diff --git a/cmd/bd/tips.go b/cmd/bd/tips.go
index 872d773b..e588c345 100644
--- a/cmd/bd/tips.go
+++ b/cmd/bd/tips.go
@@ -256,6 +256,7 @@ func isClaudeSetupComplete() bool {
 
 	// Check if beads plugin is installed - plugin now provides hooks automatically
 	settingsPath := filepath.Join(home, ".claude", "settings.json")
+	// #nosec G304 -- settingsPath is constructed from user home dir, not user input
 	if data, err := os.ReadFile(settingsPath); err == nil {
 		var settings map[string]interface{}
 		if err := json.Unmarshal(data, &settings); err == nil {
@@ -287,7 +288,7 @@ func isClaudeSetupComplete() bool {
 
 // hasBeadsPrimeHooks checks if a settings file has bd prime hooks configured
 func hasBeadsPrimeHooks(settingsPath string) bool {
-	data, err := os.ReadFile(settingsPath)
+	data, err := os.ReadFile(settingsPath) // #nosec G304 -- path is either from home dir or relative project path
 	if err != nil {
 		return false
 	}
diff --git a/internal/reset/git.go b/internal/reset/git.go
index c1b90c6f..68c7a917 100644
--- a/internal/reset/git.go
+++ b/internal/reset/git.go
@@ -72,7 +72,7 @@ func GitRemoveBeads(beadsDir string) error {
 	// Try to remove each file (git rm ignores non-existent files with --ignore-unmatch)
 	// Use --force to handle files with staged changes
 	for _, file := range jsonlFiles {
-		cmd := exec.Command("git", "rm", "--ignore-unmatch", "--quiet", "--force", file)
+		cmd := exec.Command("git", "rm", "--ignore-unmatch", "--quiet", "--force", file) // #nosec G204 -- git is a constant, file is from controlled source
 		var stderr bytes.Buffer
 		cmd.Stderr = &stderr
 
diff --git a/internal/reset/reset.go b/internal/reset/reset.go
index 536a30f0..0b78d157 100644
--- a/internal/reset/reset.go
+++ b/internal/reset/reset.go
@@ -74,7 +74,7 @@ func CountImpact() (*ImpactSummary, error) {
 		ctx := context.Background()
 		store, err := sqlite.New(ctx, dbPath)
 		if err == nil {
-			defer store.Close()
+			defer func() { _ = store.Close() }()
 
 			// Count all issues including tombstones
 			allIssues, err := store.SearchIssues(ctx, "", types.IssueFilter{IncludeTombstones: true})
diff --git a/internal/storage/sqlite/queries.go b/internal/storage/sqlite/queries.go
index e824a20d..1fc59c6e 100644
--- a/internal/storage/sqlite/queries.go
+++ b/internal/storage/sqlite/queries.go
@@ -1178,12 +1178,12 @@ func (s *SQLiteStorage) executeDelete(ctx context.Context, tx *sql.Tx, inClause
 	for rows.Next() {
 		var id, issueType string
 		if err := rows.Scan(&id, &issueType); err != nil {
-			rows.Close()
+			_ = rows.Close()
 			return fmt.Errorf("failed to scan issue type: %w", err)
 		}
 		issueTypes[id] = issueType
 	}
-	rows.Close()
+	_ = rows.Close()
 
 	// 3. Convert issues to tombstones (only for issues that exist)
 	now := time.Now()