diff --git a/pkg/ueps/reader.go b/pkg/ueps/reader.go
index bba43f6..289562b 100644
--- a/pkg/ueps/reader.go
+++ b/pkg/ueps/reader.go
@@ -35,13 +35,13 @@ func ReadAndVerify(reader *bufio.Reader, sharedSecret []byte) (*ParsedPacket, er
 	// Loop through TLVs until we hit Payload (0xFF) or EOF
 	for {
 		// 1. Read Tag
-		tag, err := reader.ReadByte()
+		tagByte, err := reader.ReadByte()
 		if err != nil {
 			return nil, err
 		}
 
 		// 2. Handle Payload Tag (0xFF) - The Exit Condition
-		if tag == TagPayload {
+		if tagByte == TagPayload {
 			// Payload is length-prefixless; caller frames the stream.
 			// HMAC covers signedData (header TLVs) + raw payload bytes, not the 0xFF tag.
 			remaining, err := io.ReadAll(reader)
@@ -65,31 +65,31 @@ func ReadAndVerify(reader *bufio.Reader, sharedSecret []byte) (*ParsedPacket, er
 			return nil, err
 		}
 
-		switch tag {
+		switch tagByte {
 		case TagVersion:
 			header.Version = tagValue[0]
 			// Reconstruct signed data: Tag + Len + Val
-			signedData.WriteByte(tag)
+			signedData.WriteByte(tagByte)
 			signedData.WriteByte(byte(tagLength))
 			signedData.Write(tagValue)
 		case TagCurrentLayer:
 			header.CurrentLayer = tagValue[0]
-			signedData.WriteByte(tag)
+			signedData.WriteByte(tagByte)
 			signedData.WriteByte(byte(tagLength))
 			signedData.Write(tagValue)
 		case TagTargetLayer:
 			header.TargetLayer = tagValue[0]
-			signedData.WriteByte(tag)
+			signedData.WriteByte(tagByte)
 			signedData.WriteByte(byte(tagLength))
 			signedData.Write(tagValue)
 		case TagIntent:
 			header.IntentID = tagValue[0]
-			signedData.WriteByte(tag)
+			signedData.WriteByte(tagByte)
 			signedData.WriteByte(byte(tagLength))
 			signedData.Write(tagValue)
 		case TagThreatScore:
 			header.ThreatScore = binary.BigEndian.Uint16(tagValue)
-			signedData.WriteByte(tag)
+			signedData.WriteByte(tagByte)
 			signedData.WriteByte(byte(tagLength))
 			signedData.Write(tagValue)
 		case TagHMAC:
@@ -97,7 +97,7 @@ func ReadAndVerify(reader *bufio.Reader, sharedSecret []byte) (*ParsedPacket, er
 			// We do NOT add the HMAC itself to signedData
 		default:
 			// Unknown tag (future proofing), verify it but ignore semantics
-			signedData.WriteByte(tag)
+			signedData.WriteByte(tagByte)
 			signedData.WriteByte(byte(tagLength))
 			signedData.Write(tagValue)
 		}