diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d2483e2b10e..1491e606b1f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -47,6 +47,9 @@ on:
       '**/*.wgsl'
     ]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
   cancel-in-progress: true
diff --git a/.github/workflows/server-metal.yml b/.github/workflows/server-metal.yml
index 1d707bef44a..5c26741b621 100644
--- a/.github/workflows/server-metal.yml
+++ b/.github/workflows/server-metal.yml
@@ -53,7 +53,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          ref: ${{ github.event.inputs.sha || github.event.pull_request.head.sha || github.sha || github.head_ref || github.ref_name }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Build
         id: cmake_build
diff --git a/.github/workflows/server-webui.yml b/.github/workflows/server-webui.yml
index 94899c93761..ab1b63987bf 100644
--- a/.github/workflows/server-webui.yml
+++ b/.github/workflows/server-webui.yml
@@ -36,7 +36,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          ref: ${{ github.event.inputs.sha || github.event.pull_request.head.sha || github.sha || github.head_ref || github.ref_name }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Setup Node.js
         id: node
diff --git a/.github/workflows/server.yml b/.github/workflows/server.yml
index 99d05226ba5..127783536ad 100644
--- a/.github/workflows/server.yml
+++ b/.github/workflows/server.yml
@@ -67,7 +67,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          ref: ${{ github.event.inputs.sha || github.event.pull_request.head.sha || github.sha || github.head_ref || github.ref_name }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Build
         id: cmake_build
@@ -115,7 +115,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          ref: ${{ github.event.inputs.sha || github.event.pull_request.head.sha || github.sha || github.head_ref || github.ref_name }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Build
         id: cmake_build
diff --git a/scripts/serve-static.js b/scripts/serve-static.js
index df4953e61ec..36e4cdb5ec5 100644
--- a/scripts/serve-static.js
+++ b/scripts/serve-static.js
@@ -24,6 +24,15 @@ const mimeTypes = {
   '.woff2': 'font/woff2',
 };
 
+function escapeHtml(value) {
+  return value
+    .replaceAll('&', '&amp;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&#39;');
+}
+
 async function generateDirListing(dirPath, reqUrl) {
   const files = await fs.readdir(dirPath);
   let html = `
@@ -40,7 +49,7 @@ async function generateDirListing(dirPath, reqUrl) {
       </style>
     </head>
     <body>
-      <h1>Directory: ${reqUrl}</h1>
+      <h1>Directory: ${escapeHtml(reqUrl)}</h1>
       <ul>
   `;
 
@@ -52,7 +61,7 @@ async function generateDirListing(dirPath, reqUrl) {
     const filePath = path.join(dirPath, file);
     const stats = await fs.stat(filePath);
     const link = encodeURIComponent(file) + (stats.isDirectory() ? '/' : '');
-    html += `<li><a href="${link}">${file}${stats.isDirectory() ? '/' : ''}</a></li>`;
+    html += `<li><a href="${link}">${escapeHtml(file)}${stats.isDirectory() ? '/' : ''}</a></li>`;
   }
 
   html += `
@@ -72,7 +81,13 @@ const server = http.createServer(async (req, res) => {
     res.setHeader('Pragma', 'no-cache');
     res.setHeader('Expires', '0');
 
-    const filePath = path.join(STATIC_DIR, decodeURIComponent(req.url));
+    const requestPath = decodeURIComponent(new URL(req.url, 'http://localhost').pathname);
+    const filePath = path.resolve(STATIC_DIR, `.${requestPath}`);
+    if (filePath !== STATIC_DIR && !filePath.startsWith(`${STATIC_DIR}${path.sep}`)) {
+      res.writeHeader(403, { 'Content-Type': 'text/plain' });
+      res.end('403 Forbidden');
+      return;
+    }
     const stats = await fs.stat(filePath);
 
     if (stats.isDirectory()) {
diff --git a/tools/server/public_simplechat/simplechat.js b/tools/server/public_simplechat/simplechat.js
index c67577d5ae7..23758440d53 100644
--- a/tools/server/public_simplechat/simplechat.js
+++ b/tools/server/public_simplechat/simplechat.js
@@ -546,7 +546,7 @@ class MultiChatUI {
             }
             this.handle_user_submit(this.curChatId, gMe.apiEP).catch((/** @type{Error} */reason)=>{
                 let msg = `ERRR:SimpleChat\nMCUI:HandleUserSubmit:${this.curChatId}\n${reason.name}:${reason.message}`;
-                console.error(msg.replace("\n", ":"));
+                console.error(msg.replace(/\n/g, ":"));
                 alert(msg);
                 this.ui_reset_userinput();
             });
