diff --git a/src/vs/base/common/hash.ts b/src/vs/base/common/hash.ts
index eafaccd761a..324f057007c 100644
--- a/src/vs/base/common/hash.ts
+++ b/src/vs/base/common/hash.ts
@@ -93,7 +93,7 @@ export const hashAsync = (input: string | ArrayBufferView | VSBuffer) => {
 		buff = input;
 	}
 
-	return crypto.subtle.digest('sha-1', buff as ArrayBufferView<ArrayBuffer>).then(toHexString);
+	return crypto.subtle.digest('sha-1', buff as ArrayBufferView<ArrayBuffer>).then(toHexString); // CodeQL [SM04514] we use sha1 here for validating old stored client state, not for security
 };
 
 const enum SHA1Constant {