diff --git a/src/Cli/func/Common/KeyVaultReferencesManager.cs b/src/Cli/func/Common/KeyVaultReferencesManager.cs
index 4a6828fa9..db77e1941 100644
--- a/src/Cli/func/Common/KeyVaultReferencesManager.cs
+++ b/src/Cli/func/Common/KeyVaultReferencesManager.cs
@@ -16,7 +16,7 @@ internal class KeyVaultReferencesManager
         private const string VaultUriSuffix = "vault.azure.net";
         private static readonly Regex _basicKeyVaultReferenceRegex = new Regex(@"^@Microsoft\.KeyVault\((?<ReferenceString>.*)\)$", RegexOptions.Compiled);
         private readonly ConcurrentDictionary<string, SecretClient> _clients = new ConcurrentDictionary<string, SecretClient>();
-        private readonly TokenCredential _credential = new DefaultAzureCredential();
+        private readonly TokenCredential _credential = new DefaultAzureCredential(); // CodeQL [SM05137] This is never deployed to production, only used in CLI context in a local dev environment.
 
         public void ResolveKeyVaultReferences(IDictionary<string, string> settings)
         {