diff --git a/pkg/cmd/auth/token/token.go b/pkg/cmd/auth/token/token.go
index 9f4dcc1ac..7ac65d37e 100644
--- a/pkg/cmd/auth/token/token.go
+++ b/pkg/cmd/auth/token/token.go
@@ -88,7 +88,7 @@ func tokenRun(opts *TokenOptions) error {
 		if opts.Username != "" {
 			errMsg += fmt.Sprintf(" account %s", opts.Username)
 		}
-		return fmt.Errorf(errMsg)
+		return fmt.Errorf("%s", errMsg)
 	}
 
 	if val != "" {
diff --git a/pkg/cmd/codespace/create_test.go b/pkg/cmd/codespace/create_test.go
index 6466d9be7..85d311a47 100644
--- a/pkg/cmd/codespace/create_test.go
+++ b/pkg/cmd/codespace/create_test.go
@@ -648,14 +648,14 @@ Alternatively, you can run "create" with the "--default-permissions" option to c
 				assert.EqualError(t, err, tt.wantErr.Error())
 			}
 			if err != nil && tt.wantErr == nil {
-				t.Logf(err.Error())
+				t.Logf("%s", err.Error())
 			}
 			if got := stdout.String(); got != tt.wantStdout {
-				t.Logf(t.Name())
+				t.Logf("%s", t.Name())
 				t.Errorf("  stdout = %v, want %v", got, tt.wantStdout)
 			}
 			if got := stderr.String(); got != tt.wantStderr {
-				t.Logf(t.Name())
+				t.Logf("%s", t.Name())
 				t.Errorf("  stderr = %v, want %v", got, tt.wantStderr)
 			}
 
diff --git a/pkg/cmd/pr/merge/merge.go b/pkg/cmd/pr/merge/merge.go
index 6696fac85..422b5e93e 100644
--- a/pkg/cmd/pr/merge/merge.go
+++ b/pkg/cmd/pr/merge/merge.go
@@ -384,13 +384,14 @@ func (m *mergeContext) deleteLocalBranch() error {
 
 	if m.merged {
 		if m.opts.IO.CanPrompt() && !m.opts.IsDeleteBranchIndicated {
-			confirmed, err := m.opts.Prompter.Confirm(fmt.Sprintf("Pull request %s#%d was already merged. Delete the branch locally?", ghrepo.FullName(m.baseRepo), m.pr.Number), false)
+			message := fmt.Sprintf("Pull request %s#%d was already merged. Delete the branch locally?", ghrepo.FullName(m.baseRepo), m.pr.Number)
+			confirmed, err := m.opts.Prompter.Confirm(message, false)
 			if err != nil {
 				return fmt.Errorf("could not prompt: %w", err)
 			}
 			m.deleteBranch = confirmed
 		} else {
-			_ = m.warnf(fmt.Sprintf("%s Pull request %s#%d was already merged\n", m.cs.WarningIcon(), ghrepo.FullName(m.baseRepo), m.pr.Number))
+			_ = m.warnf("%s Pull request %s#%d was already merged\n", m.cs.WarningIcon(), ghrepo.FullName(m.baseRepo), m.pr.Number)
 		}
 	}
 
@@ -431,7 +432,7 @@ func (m *mergeContext) deleteLocalBranch() error {
 		}
 
 		if err := m.opts.GitClient.Pull(ctx, baseRemote.Name, targetBranch); err != nil {
-			_ = m.warnf(fmt.Sprintf("%s warning: not possible to fast-forward to: %q\n", m.cs.WarningIcon(), targetBranch))
+			_ = m.warnf("%s warning: not possible to fast-forward to: %q\n", m.cs.WarningIcon(), targetBranch)
 		}
 
 		switchedToBranch = targetBranch
diff --git a/pkg/cmd/repo/view/view.go b/pkg/cmd/repo/view/view.go
index d0370203a..f8cbcb18e 100644
--- a/pkg/cmd/repo/view/view.go
+++ b/pkg/cmd/repo/view/view.go
@@ -156,7 +156,7 @@ func viewRun(opts *ViewOptions) error {
 		fmt.Fprintf(stdout, "description:\t%s\n", repo.Description)
 		if readme != nil {
 			fmt.Fprintln(stdout, "--")
-			fmt.Fprintf(stdout, readme.Content)
+			fmt.Fprintf(stdout, "%s", readme.Content)
 			fmt.Fprintln(stdout)
 		}