diff --git a/.github/actions/install-dependencies/action.yml b/.github/actions/install-dependencies/action.yml
index 80733dd3..d4a434a7 100644
--- a/.github/actions/install-dependencies/action.yml
+++ b/.github/actions/install-dependencies/action.yml
@@ -9,13 +9,13 @@ runs:
   using: 'composite'
   steps:
     - name: Install pnpm
-      uses: pnpm/action-setup@v5
+      uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       with:
         version: 9.15.9
         cache: true
 
     - name: Install Node.js ${{ inputs.node-version }}
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ inputs.node-version }}
         cache: 'pnpm'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9bb35b20..f80fe3ef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Dependencies
         uses: ./.github/actions/install-dependencies
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Dependencies
         uses: ./.github/actions/install-dependencies
@@ -50,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Dependencies
         uses: ./.github/actions/install-dependencies
diff --git a/.github/workflows/code-review.yml b/.github/workflows/code-review.yml
index f0bd194b..43293d3e 100644
--- a/.github/workflows/code-review.yml
+++ b/.github/workflows/code-review.yml
@@ -17,7 +17,7 @@ jobs:
   ai-code-review:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           token: ${{ secrets.CUSTOM_GITHUB_TOKEN }}
@@ -50,7 +50,7 @@ jobs:
           cat ${{ github.workspace }}/*.log
 
       - name: Update PR Status
-        uses: actions/github-script@v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/manual-cleanup.yml b/.github/workflows/manual-cleanup.yml
index d1a26296..cd7030cb 100644
--- a/.github/workflows/manual-cleanup.yml
+++ b/.github/workflows/manual-cleanup.yml
@@ -65,7 +65,7 @@ jobs:
 
             - name: Checkout code for build artifact cleanup
               if: ${{ inputs.clean_build }}
-              uses: actions/checkout@v4
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
               with:
                   fetch-depth: 1
 
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
new file mode 100644
index 00000000..32a19462
--- /dev/null
+++ b/.github/workflows/ossf-scorecard.yml
@@ -0,0 +1,48 @@
+name: OSSF Scorecard
+
+on:
+  pull_request:
+    branches: ['main']
+  schedule:
+    - cron: '0 6 * * 1' # weekly measurement on the default branch
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  scorecard:
+    name: OSSF Scorecard
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      THRESHOLD: '8'
+      MODE: 'warn'
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run Scorecard
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.json
+          results_format: json
+          publish_results: false
+
+      - name: Gate on aggregate score
+        run: |
+          SCORE=$(jq -r '.score' results.json)
+          echo "OSSF aggregate = ${SCORE}  (threshold ${THRESHOLD}, mode ${MODE})"
+          if [ "$SCORE" = "-1" ] || [ "$SCORE" = "null" ]; then
+            echo "::warning::Scorecard returned inconclusive score — not gating"; exit 0
+          fi
+          below=$(awk -v s="$SCORE" -v t="$THRESHOLD" 'BEGIN{print (s<t)?1:0}')
+          if [ "$below" = "1" ]; then
+            if [ "$MODE" = "enforce" ]; then
+              echo "::error::OSSF ${SCORE} < ${THRESHOLD} — blocking merge"; exit 1
+            else
+              echo "::warning::OSSF ${SCORE} < ${THRESHOLD} — warn mode, not blocking"
+            fi
+          fi
+
diff --git a/.github/workflows/osv-scanner-pr.yml b/.github/workflows/osv-scanner-pr.yml
index 774faf78..b7080b0c 100644
--- a/.github/workflows/osv-scanner-pr.yml
+++ b/.github/workflows/osv-scanner-pr.yml
@@ -16,4 +16,4 @@ permissions:
 
 jobs:
   scan-pr:
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.2.2"
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@9a498708959aeaef5ef730655706c5a1df1edbc2" # v2.3.8
diff --git a/.github/workflows/prereleases.yml b/.github/workflows/prereleases.yml
index 4938c8da..a551db36 100644
--- a/.github/workflows/prereleases.yml
+++ b/.github/workflows/prereleases.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d5bcfd90..e290c1dc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,7 +13,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           token: ${{ secrets.CUSTOM_GITHUB_TOKEN }}
@@ -28,7 +28,7 @@ jobs:
 
       - name: Create Version PR or Publish to NPM
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
         with:
           publish: pnpm exec changeset publish
           commit: 'chore: version packages'
diff --git a/.github/workflows/scc-checker.yml b/.github/workflows/scc-checker.yml
index a01a37e2..062702ae 100644
--- a/.github/workflows/scc-checker.yml
+++ b/.github/workflows/scc-checker.yml
@@ -11,8 +11,8 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
-      - uses: aziontech/scc_check@main
+      - uses: aziontech/scc_check@ef8c23bc9056bf6c21cc8a391fed67412a5fd3c1 # main
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..8f1867bb
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,24 @@
+# Security Policy
+
+## Supported Versions
+
+Security updates are provided for the latest published release of each
+`@aziontech/*` package in this repository. Please make sure you are running the
+most recent version before reporting an issue.
+
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+Instead, please report them via `GitHub Security Advisories`:
+
+1. Go to the **Security** tab of this repository
+2. Click **Report a vulnerability**
+3. Fill out the vulnerability report form
+
+Please include as much detail as possible:
+
+- A description of the vulnerability and its impact.
+- Steps to reproduce (proof of concept, affected version, environment).
+- Any suggested remediation, if known.