diff --git a/web/src/components/landing/LandingPageDesktop.tsx b/web/src/components/landing/LandingPageDesktop.tsx
index 0ebfade3..a08de664 100644
--- a/web/src/components/landing/LandingPageDesktop.tsx
+++ b/web/src/components/landing/LandingPageDesktop.tsx
@@ -40,7 +40,6 @@ const SPRITE_STYLES = `
 const Sprite: React.FC = () => (
   <svg className="lp-sprite" aria-hidden="true">
     <defs>
-      {/* eslint-disable-next-line react/no-danger */}
       <style dangerouslySetInnerHTML={{ __html: SPRITE_STYLES }} />
       {/* Finance */}
       <symbol id="lp-i-wallet" viewBox="0 0 32 32">
diff --git a/web/supabase/functions/telegram-auth/index.ts b/web/supabase/functions/telegram-auth/index.ts
index 2fb6f8c7..286befc7 100644
--- a/web/supabase/functions/telegram-auth/index.ts
+++ b/web/supabase/functions/telegram-auth/index.ts
@@ -14,16 +14,8 @@ async function verifyTelegramHash(data: Record<string, string>, botToken: string
     .map(([k, v]) => `${k}=${v}`)
     .join('\n')
 
-  // secret_key = SHA-256(bot_token)
+  // Telegram Login Widget: secret_key = SHA-256(bot_token), used as HMAC key
   const encoder = new TextEncoder()
-  const keyMaterial = await crypto.subtle.importKey(
-    'raw',
-    encoder.encode(botToken),
-    { name: 'HMAC', hash: 'SHA-256' },
-    false,
-    ['sign']
-  )
-  // Telegram Login Widget uses SHA-256(bot_token) as HMAC key — import as raw bytes
   const secretKeyBytes = await crypto.subtle.digest('SHA-256', encoder.encode(botToken))
   const hmacKey = await crypto.subtle.importKey(
     'raw',