diff --git a/napalm_bsd/base.py b/napalm_bsd/base.py
index e9e9e8c..89f9967 100644
--- a/napalm_bsd/base.py
+++ b/napalm_bsd/base.py
@@ -55,7 +55,8 @@ _PRIVILEGED_STDIN = (
 
 #: Stages content without privilege: a fresh ``mktemp`` file only the login user
 #: may read, never a fixed name another user could create first. Prints its path.
-_STAGE_TEMPLATE = "/tmp/napalm-bsd-stage.XXXXXX"
+#: The path is on the device, not a local temp file.
+_STAGE_TEMPLATE = "/tmp/napalm-bsd-stage.XXXXXX"  # nosec B108
 _STAGE_PREFIX = _STAGE_TEMPLATE[: -len("XXXXXX")]
 _STAGE = (
     f"umask 077 && t=$(mktemp {_STAGE_TEMPLATE}) && "
diff --git a/napalm_bsd/parse.py b/napalm_bsd/parse.py
index a8968a3..4f93e70 100644
--- a/napalm_bsd/parse.py
+++ b/napalm_bsd/parse.py
@@ -259,6 +259,11 @@ def boottime(text: str) -> int | None:
     return int(match[1]) if match else None
 
 
+#: The wildcard addresses a socket listens on: reported as data, never bound to.
+_ANY_V4 = "0.0.0.0"  # nosec B104
+_ANY_V6 = "::"
+
+
 def _socket(
     proto: str, local: str, family: str, process: str | None, pid: int | None
 ) -> dict[str, Any] | None:
@@ -275,7 +280,7 @@ def _socket(
         return None
     address, _, zone = address.partition("%")
     if address == "*":
-        address = "0.0.0.0" if family == "4" else "::"
+        address = _ANY_V4 if family == "4" else _ANY_V6
     return {
         "proto": proto,
         "address": address,