diff --git a/sonar-project.properties b/sonar-project.properties
index 25c218307..a7b8a9d27 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -19,7 +19,9 @@ sonar.test.inclusions=\
    shared/src/**/*.spec.ts,\
    plugin-sdk/test/**/*.test.ts
 
-# Keep generated output and test files out of source analysis
+# Keep generated output, test files and media out of source analysis (the
+# mascot clips under client/src are video; read as text they only fill the
+# log with encoding warnings)
 sonar.exclusions=\
    **/node_modules/**,\
    **/dist/**,\
@@ -29,7 +31,16 @@ sonar.exclusions=\
    **/*.test.ts,\
    **/*.test.tsx,\
    **/*.spec.ts,\
-   **/*.d.ts
+   **/*.d.ts,\
+   **/*.mp4,\
+   client/src/main.tsx
+
+# client/src/main.tsx above is the React root (the stylesheets and the mount
+# call around <App/>). From it the JS security sensor simulates rendering
+# the whole app, and that simulation ran into its fixed 300 s limit on every
+# scan, which was most of the scan's time. The file holds no logic of its
+# own; everything it renders is analysed through its own files. The vitest
+# config leaves it out of coverage for the same reason.
 
 # Coverage — lcov paths relative to repo root, one per package
 # (each package's vitest config emits lcov to <pkg>/coverage/).