fix: address OpenSSF Scorecard findings

.github/workflows/claude.yml

@@ -9,6 +9,8 @@
   pull_request_review_comment:
     types: [created]
 
+permissions: read-all
+
 jobs:
   claude:
     if: >-

.github/workflows/codeql-analysis.yml

@@ -10,6 +10,8 @@
   schedule:
     - cron: '0 6 * * 1'
 
+permissions: read-all
+
 jobs:
   analyze:
     name: Analyze (Python)
@@ -19,14 +21,14 @@
       security-events: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@5c8a8a642e79153f5d047b10ec1cba1d1cc65699 # v3
         with:
           languages: python
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@5c8a8a642e79153f5d047b10ec1cba1d1cc65699 # v3
         with:
           category: '/language:python'

.github/workflows/dependabot-automerge.yml

@@ -5,25 +5,26 @@
     branches:
       - main
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: read-all
 
 jobs:
   dependabot:
     runs-on: ubuntu-latest
     if: github.event.pull_request.user.login == 'dependabot[bot]'
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # v2
         with:
           github-token: '${{ secrets.GITHUB_TOKEN }}'
 
       - name: Generate app token
         if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.dependency-type == 'indirect'
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}

.github/workflows/sonarcloud.yml

@@ -1,16 +1,20 @@
 name: SonarCloud Analysis
-permissions:
-  contents: read
-  pull-requests: read
+
 on:
   push:
     branches: [main]
   pull_request:
     branches: [main]
+
+permissions: read-all
+
 jobs:
   sonarcloud:
     name: SonarCloud
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     env:
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
     steps:

SECURITY.md

@@ -0,0 +1,33 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| latest  | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in this project, please report it responsibly.
+
+**Please do NOT open a public GitHub issue for security vulnerabilities.**
+
+Instead, please send an email to the repository maintainers or use [GitHub's private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-creating-advisories/privately-reporting-a-security-vulnerability) feature on this repository.
+
+When reporting a vulnerability, please include:
+
+- A description of the vulnerability
+- Steps to reproduce the issue
+- Potential impact of the vulnerability
+- Suggested fix (if any)
+
+## Response Timeline
+
+- We will acknowledge receipt of your report within **48 hours**.
+- We will provide an initial assessment within **5 business days**.
+- We aim to release a fix within **30 days** of confirming the vulnerability.
+
+## Security Best Practices
+
+- Keep your dependencies up to date.
+- Review the project's dependency tree for known vulnerabilities using `pip audit` or similar tools.