diff --git a/.github/workflows/api-bump-version.yml b/.github/workflows/api-bump-version.yml
index 7ddbf195f5..9f5e586cb8 100644
--- a/.github/workflows/api-bump-version.yml
+++ b/.github/workflows/api-bump-version.yml
@@ -13,6 +13,9 @@ env:
   PROWLER_VERSION: ${{ github.event.release.tag_name }}
   BASE_BRANCH: master
 
+permissions:
+  contents: read
+
 jobs:
   detect-release-type:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/api-code-quality.yml b/.github/workflows/api-code-quality.yml
index 27bd65bea9..4d208ea52b 100644
--- a/.github/workflows/api-code-quality.yml
+++ b/.github/workflows/api-code-quality.yml
@@ -17,6 +17,9 @@ concurrency:
 env:
   API_WORKING_DIR: ./api
 
+permissions:
+  contents: read
+
 jobs:
   api-code-quality:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/api-codeql.yml b/.github/workflows/api-codeql.yml
index 47f165cb80..9f11013527 100644
--- a/.github/workflows/api-codeql.yml
+++ b/.github/workflows/api-codeql.yml
@@ -24,6 +24,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   api-analyze:
     name: CodeQL Security Analysis
diff --git a/.github/workflows/api-container-build-push.yml b/.github/workflows/api-container-build-push.yml
index f98dc06e46..976d7c7fca 100644
--- a/.github/workflows/api-container-build-push.yml
+++ b/.github/workflows/api-container-build-push.yml
@@ -33,6 +33,9 @@ env:
   PROWLERCLOUD_DOCKERHUB_REPOSITORY: prowlercloud
   PROWLERCLOUD_DOCKERHUB_IMAGE: prowler-api
 
+permissions:
+  contents: read
+
 jobs:
   setup:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/api-container-checks.yml b/.github/workflows/api-container-checks.yml
index 96eb06269a..dcb79c0db7 100644
--- a/.github/workflows/api-container-checks.yml
+++ b/.github/workflows/api-container-checks.yml
@@ -18,6 +18,9 @@ env:
   API_WORKING_DIR: ./api
   IMAGE_NAME: prowler-api
 
+permissions:
+  contents: read
+
 jobs:
   api-dockerfile-lint:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/api-security.yml b/.github/workflows/api-security.yml
index e3c0a289ad..351e0d6032 100644
--- a/.github/workflows/api-security.yml
+++ b/.github/workflows/api-security.yml
@@ -17,6 +17,9 @@ concurrency:
 env:
   API_WORKING_DIR: ./api
 
+permissions:
+  contents: read
+
 jobs:
   api-security-scans:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/api-tests.yml b/.github/workflows/api-tests.yml
index abaf3dbbe8..f57635ff72 100644
--- a/.github/workflows/api-tests.yml
+++ b/.github/workflows/api-tests.yml
@@ -27,6 +27,9 @@ env:
   VALKEY_DB: 0
   API_WORKING_DIR: ./api
 
+permissions:
+  contents: read
+
 jobs:
   api-tests:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index abf441e603..3c7b19a121 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -17,6 +17,9 @@ env:
   BACKPORT_LABEL_PREFIX: backport-to-
   BACKPORT_LABEL_IGNORE: was-backported
 
+permissions:
+  contents: read
+
 jobs:
   backport:
     if: github.event.pull_request.merged == true && !(contains(github.event.pull_request.labels.*.name, 'backport')) && !(contains(github.event.pull_request.labels.*.name, 'was-backported'))
diff --git a/.github/workflows/ci-zizmor.yml b/.github/workflows/ci-zizmor.yml
index 4d8f0ceb46..0c421d4fcf 100644
--- a/.github/workflows/ci-zizmor.yml
+++ b/.github/workflows/ci-zizmor.yml
@@ -21,6 +21,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   zizmor:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/comment-label-update.yml b/.github/workflows/comment-label-update.yml
index 3f5f3bb01f..818f1ba09b 100644
--- a/.github/workflows/comment-label-update.yml
+++ b/.github/workflows/comment-label-update.yml
@@ -9,6 +9,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.issue.number }}
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   update-labels:
     if: contains(github.event.issue.labels.*.name, 'status/awaiting-response')
diff --git a/.github/workflows/conventional-commit.yml b/.github/workflows/conventional-commit.yml
index a1195ef389..772c45a26f 100644
--- a/.github/workflows/conventional-commit.yml
+++ b/.github/workflows/conventional-commit.yml
@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   conventional-commit-check:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/create-backport-label.yml b/.github/workflows/create-backport-label.yml
index 334406f76f..15189f72b4 100644
--- a/.github/workflows/create-backport-label.yml
+++ b/.github/workflows/create-backport-label.yml
@@ -13,6 +13,9 @@ env:
   BACKPORT_LABEL_PREFIX: backport-to-
   BACKPORT_LABEL_COLOR: B60205
 
+permissions:
+  contents: read
+
 jobs:
   create-label:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/docs-bump-version.yml b/.github/workflows/docs-bump-version.yml
index e8c33ae53e..17cd9a8d51 100644
--- a/.github/workflows/docs-bump-version.yml
+++ b/.github/workflows/docs-bump-version.yml
@@ -13,6 +13,9 @@ env:
   PROWLER_VERSION: ${{ github.event.release.tag_name }}
   BASE_BRANCH: master
 
+permissions:
+  contents: read
+
 jobs:
   detect-release-type:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/find-secrets.yml b/.github/workflows/find-secrets.yml
index 08937815a3..e0d335ea04 100644
--- a/.github/workflows/find-secrets.yml
+++ b/.github/workflows/find-secrets.yml
@@ -14,6 +14,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   scan-secrets:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/helm-chart-checks.yml b/.github/workflows/helm-chart-checks.yml
index a0a24c2516..c1025e7705 100644
--- a/.github/workflows/helm-chart-checks.yml
+++ b/.github/workflows/helm-chart-checks.yml
@@ -21,6 +21,9 @@ concurrency:
 env:
   CHART_PATH: contrib/k8s/helm/prowler-app
 
+permissions:
+  contents: read
+
 jobs:
   helm-lint:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/helm-chart-release.yml b/.github/workflows/helm-chart-release.yml
index c0c5773bdb..5184f704fb 100644
--- a/.github/workflows/helm-chart-release.yml
+++ b/.github/workflows/helm-chart-release.yml
@@ -13,6 +13,9 @@ concurrency:
 env:
   CHART_PATH: contrib/k8s/helm/prowler-app
 
+permissions:
+  contents: read
+
 jobs:
   release-helm-chart:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index f4a136f7fd..4c52a1978e 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -15,6 +15,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   labeler:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/mcp-container-build-push.yml b/.github/workflows/mcp-container-build-push.yml
index fa29cf43ca..0f5624a453 100644
--- a/.github/workflows/mcp-container-build-push.yml
+++ b/.github/workflows/mcp-container-build-push.yml
@@ -32,6 +32,9 @@ env:
   PROWLERCLOUD_DOCKERHUB_REPOSITORY: prowlercloud
   PROWLERCLOUD_DOCKERHUB_IMAGE: prowler-mcp
 
+permissions:
+  contents: read
+
 jobs:
   setup:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/mcp-container-checks.yml b/.github/workflows/mcp-container-checks.yml
index 5fb6b65d4e..7fa04c6401 100644
--- a/.github/workflows/mcp-container-checks.yml
+++ b/.github/workflows/mcp-container-checks.yml
@@ -18,6 +18,9 @@ env:
   MCP_WORKING_DIR: ./mcp_server
   IMAGE_NAME: prowler-mcp
 
+permissions:
+  contents: read
+
 jobs:
   mcp-dockerfile-lint:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/mcp-pypi-release.yml b/.github/workflows/mcp-pypi-release.yml
index d6272034ec..e2c83e28f7 100644
--- a/.github/workflows/mcp-pypi-release.yml
+++ b/.github/workflows/mcp-pypi-release.yml
@@ -14,6 +14,9 @@ env:
   PYTHON_VERSION: "3.12"
   WORKING_DIRECTORY: ./mcp_server
 
+permissions:
+  contents: read
+
 jobs:
   validate-release:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/pr-check-changelog.yml b/.github/workflows/pr-check-changelog.yml
index 1439833499..74f138c96e 100644
--- a/.github/workflows/pr-check-changelog.yml
+++ b/.github/workflows/pr-check-changelog.yml
@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   check-changelog:
     if: contains(github.event.pull_request.labels.*.name, 'no-changelog') == false
diff --git a/.github/workflows/pr-conflict-checker.yml b/.github/workflows/pr-conflict-checker.yml
index 330a038fa0..d30912ba55 100644
--- a/.github/workflows/pr-conflict-checker.yml
+++ b/.github/workflows/pr-conflict-checker.yml
@@ -15,6 +15,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   check-conflicts:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pr-merged.yml b/.github/workflows/pr-merged.yml
index 6b18eb40c1..0276dd69fc 100644
--- a/.github/workflows/pr-merged.yml
+++ b/.github/workflows/pr-merged.yml
@@ -12,6 +12,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   trigger-cloud-pull-request:
     if: |
diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
index f0aee83174..231c5bdffb 100644
--- a/.github/workflows/prepare-release.yml
+++ b/.github/workflows/prepare-release.yml
@@ -17,6 +17,9 @@ concurrency:
 env:
   PROWLER_VERSION: ${{ inputs.prowler_version }}
 
+permissions:
+  contents: read
+
 jobs:
   prepare-release:
     if: github.event_name == 'workflow_dispatch' && github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/sdk-bump-version.yml b/.github/workflows/sdk-bump-version.yml
index 99010c6af3..d82a85eb14 100644
--- a/.github/workflows/sdk-bump-version.yml
+++ b/.github/workflows/sdk-bump-version.yml
@@ -13,6 +13,9 @@ env:
   PROWLER_VERSION: ${{ github.event.release.tag_name }}
   BASE_BRANCH: master
 
+permissions:
+  contents: read
+
 jobs:
   detect-release-type:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/sdk-check-duplicate-test-names.yml b/.github/workflows/sdk-check-duplicate-test-names.yml
index c5f2ddee32..5f6310e0c4 100644
--- a/.github/workflows/sdk-check-duplicate-test-names.yml
+++ b/.github/workflows/sdk-check-duplicate-test-names.yml
@@ -10,6 +10,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   check-duplicate-test-names:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/sdk-code-quality.yml b/.github/workflows/sdk-code-quality.yml
index db6eae1e0b..2bb4a7ec2f 100644
--- a/.github/workflows/sdk-code-quality.yml
+++ b/.github/workflows/sdk-code-quality.yml
@@ -14,6 +14,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   sdk-code-quality:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/sdk-codeql.yml b/.github/workflows/sdk-codeql.yml
index 372b1f78fb..682012cc8c 100644
--- a/.github/workflows/sdk-codeql.yml
+++ b/.github/workflows/sdk-codeql.yml
@@ -30,6 +30,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   sdk-analyze:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/sdk-container-build-push.yml b/.github/workflows/sdk-container-build-push.yml
index de45f325c9..7644808079 100644
--- a/.github/workflows/sdk-container-build-push.yml
+++ b/.github/workflows/sdk-container-build-push.yml
@@ -46,6 +46,9 @@ env:
   # AWS configuration (for ECR)
   AWS_REGION: us-east-1
 
+permissions:
+  contents: read
+
 jobs:
   setup:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/sdk-container-checks.yml b/.github/workflows/sdk-container-checks.yml
index 21fd089ad7..0c8e82a2b7 100644
--- a/.github/workflows/sdk-container-checks.yml
+++ b/.github/workflows/sdk-container-checks.yml
@@ -17,6 +17,9 @@ concurrency:
 env:
   IMAGE_NAME: prowler
 
+permissions:
+  contents: read
+
 jobs:
   sdk-dockerfile-lint:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/sdk-pypi-release.yml b/.github/workflows/sdk-pypi-release.yml
index 5173760205..13ce36c4a0 100644
--- a/.github/workflows/sdk-pypi-release.yml
+++ b/.github/workflows/sdk-pypi-release.yml
@@ -13,6 +13,9 @@ env:
   RELEASE_TAG: ${{ github.event.release.tag_name }}
   PYTHON_VERSION: '3.12'
 
+permissions:
+  contents: read
+
 jobs:
   validate-release:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/sdk-refresh-aws-services-regions.yml b/.github/workflows/sdk-refresh-aws-services-regions.yml
index ce8d1c8292..233826ba7a 100644
--- a/.github/workflows/sdk-refresh-aws-services-regions.yml
+++ b/.github/workflows/sdk-refresh-aws-services-regions.yml
@@ -13,6 +13,9 @@ env:
   PYTHON_VERSION: '3.12'
   AWS_REGION: 'us-east-1'
 
+permissions:
+  contents: read
+
 jobs:
   refresh-aws-regions:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/sdk-refresh-oci-regions.yml b/.github/workflows/sdk-refresh-oci-regions.yml
index 67f87076b7..6e3a12f581 100644
--- a/.github/workflows/sdk-refresh-oci-regions.yml
+++ b/.github/workflows/sdk-refresh-oci-regions.yml
@@ -12,6 +12,9 @@ concurrency:
 env:
   PYTHON_VERSION: '3.12'
 
+permissions:
+  contents: read
+
 jobs:
   refresh-oci-regions:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/sdk-security.yml b/.github/workflows/sdk-security.yml
index bc07101646..3828589b9f 100644
--- a/.github/workflows/sdk-security.yml
+++ b/.github/workflows/sdk-security.yml
@@ -14,6 +14,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   sdk-security-scans:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/sdk-tests.yml b/.github/workflows/sdk-tests.yml
index 42e6b15291..59012ef536 100644
--- a/.github/workflows/sdk-tests.yml
+++ b/.github/workflows/sdk-tests.yml
@@ -14,6 +14,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   sdk-tests:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/test-impact-analysis.yml b/.github/workflows/test-impact-analysis.yml
index be7361a71c..3c2cb4fad0 100644
--- a/.github/workflows/test-impact-analysis.yml
+++ b/.github/workflows/test-impact-analysis.yml
@@ -31,6 +31,9 @@ on:
         description: "Whether there are UI E2E tests to run"
         value: ${{ jobs.analyze.outputs.has-ui-e2e }}
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ui-bump-version.yml b/.github/workflows/ui-bump-version.yml
index 9566c53006..8ba64da5f7 100644
--- a/.github/workflows/ui-bump-version.yml
+++ b/.github/workflows/ui-bump-version.yml
@@ -13,6 +13,9 @@ env:
   PROWLER_VERSION: ${{ github.event.release.tag_name }}
   BASE_BRANCH: master
 
+permissions:
+  contents: read
+
 jobs:
   detect-release-type:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ui-codeql.yml b/.github/workflows/ui-codeql.yml
index dd1c443f7c..15c74248e3 100644
--- a/.github/workflows/ui-codeql.yml
+++ b/.github/workflows/ui-codeql.yml
@@ -26,6 +26,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   ui-analyze:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/ui-container-build-push.yml b/.github/workflows/ui-container-build-push.yml
index eb2a4a7cd3..cd440fb18f 100644
--- a/.github/workflows/ui-container-build-push.yml
+++ b/.github/workflows/ui-container-build-push.yml
@@ -35,6 +35,9 @@ env:
   # Build args
   NEXT_PUBLIC_API_BASE_URL: http://prowler-api:8080/api/v1
 
+permissions:
+  contents: read
+
 jobs:
   setup:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/ui-container-checks.yml b/.github/workflows/ui-container-checks.yml
index 8a0f6950d8..5ff373513c 100644
--- a/.github/workflows/ui-container-checks.yml
+++ b/.github/workflows/ui-container-checks.yml
@@ -18,6 +18,9 @@ env:
   UI_WORKING_DIR: ./ui
   IMAGE_NAME: prowler-ui
 
+permissions:
+  contents: read
+
 jobs:
   ui-dockerfile-lint:
     if: github.repository == 'prowler-cloud/prowler'
diff --git a/.github/workflows/ui-e2e-tests-v2.yml b/.github/workflows/ui-e2e-tests-v2.yml
index 917d304e30..849ae2f9d7 100644
--- a/.github/workflows/ui-e2e-tests-v2.yml
+++ b/.github/workflows/ui-e2e-tests-v2.yml
@@ -15,6 +15,9 @@ on:
       - 'ui/**'
       - 'api/**'  # API changes can affect UI E2E
 
+permissions:
+  contents: read
+
 jobs:
   # First, analyze which tests need to run
   impact-analysis:
diff --git a/.github/workflows/ui-tests.yml b/.github/workflows/ui-tests.yml
index 7009e67f04..f9dd005837 100644
--- a/.github/workflows/ui-tests.yml
+++ b/.github/workflows/ui-tests.yml
@@ -18,6 +18,9 @@ env:
   UI_WORKING_DIR: ./ui
   NODE_VERSION: '24.13.0'
 
+permissions:
+  contents: read
+
 jobs:
   ui-tests:
     runs-on: ubuntu-latest