diff --git a/apps/api/plane/app/views/issue/comment.py b/apps/api/plane/app/views/issue/comment.py
index 1e0928a4a9..11d4b8f527 100644
--- a/apps/api/plane/app/views/issue/comment.py
+++ b/apps/api/plane/app/views/issue/comment.py
@@ -67,7 +67,7 @@ class IssueCommentViewSet(BaseViewSet):
         # checks that the caller is a member of `project_id`, never that `issue_id` lives in
         # it, so a bare pk lookup let any project member comment on an issue in another
         # project/workspace — and read that issue's full `issue_detail` back out of the 201
-        # response (GHSA-hvx3-58mp-5fpx).
+        # response.
         issue = Issue.objects.filter(pk=issue_id, workspace__slug=slug, project_id=project_id).first()
         if issue is None:
             return Response({"error": "Issue not found"}, status=status.HTTP_404_NOT_FOUND)
diff --git a/apps/api/plane/app/views/issue/relation.py b/apps/api/plane/app/views/issue/relation.py
index b738c41f05..30b2ab9e28 100644
--- a/apps/api/plane/app/views/issue/relation.py
+++ b/apps/api/plane/app/views/issue/relation.py
@@ -40,7 +40,7 @@ def issue_in_project(issue_id, slug, project_id):
     ``ProjectEntityPermission`` only checks that the caller is a member of the URL's
     ``project_id`` — it never binds the sibling ``issue_id`` path parameter to that
     project. Every handler taking both must therefore check this itself, or it is
-    reachable cross-project/cross-tenant (GHSA-hvx3-58mp-5fpx).
+    reachable cross-project/cross-tenant.
     """
     return Issue.issue_objects.filter(pk=issue_id, workspace__slug=slug, project_id=project_id).exists()
 
diff --git a/apps/api/plane/tests/contract/app/test_issue_subresource_scope_app.py b/apps/api/plane/tests/contract/app/test_issue_subresource_scope_app.py
index ecc38d1574..83cbdffb06 100644
--- a/apps/api/plane/tests/contract/app/test_issue_subresource_scope_app.py
+++ b/apps/api/plane/tests/contract/app/test_issue_subresource_scope_app.py
@@ -4,7 +4,7 @@
 
 """Contract tests for issue sub-resource scoping on comment + relation endpoints.
 
-Regression coverage for GHSA-hvx3-58mp-5fpx (SECUR-243).
+Regression coverage for SECUR-243.
 
 ``ProjectEntityPermission`` / ``allow_permission`` validate only that the caller is
 an active member of the URL's ``project_id``. Neither validates that the sibling