diff --git a/.github/workflows/frogbot.yml b/.github/workflows/frogbot.yml
index 64c7c87..f2eb31a 100644
--- a/.github/workflows/frogbot.yml
+++ b/.github/workflows/frogbot.yml
@@ -1,3 +1,4 @@
+# workflow-hardening: 1 finding needs manual review — see PR description
 name: "Frogbot Security Scan"
 
 on: