diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 26a093d..f206f0e 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -21,11 +21,11 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
         with:
           version: 10.33.0
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: "24"
           cache: "pnpm"
@@ -43,7 +43,7 @@ jobs:
           fail_ci_if_error: true
       - run: pnpm build
       - run: pnpm test:integration
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: "20"
           cache: "pnpm"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index c9ef60e..65f3b45 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -2,9 +2,7 @@ name: Release
 
 on: workflow_dispatch
 
-permissions:
-  contents: write
-  id-token: write
+permissions: {}
 
 concurrency:
   group: release
@@ -14,15 +12,20 @@ jobs:
   release:
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    # contents: write pushes the release tag and GitHub release;
+    # id-token: write mints the OIDC token for npm trusted publishing.
+    permissions:
+      contents: write
+      id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
           persist-credentials: false
       - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
         with:
           version: 10.33.0
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: "24"
           package-manager-cache: false
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..4601051
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,29 @@
+# Security Policy
+
+## Supported versions
+
+Only the latest published release of `dialcache` receives security fixes.
+
+## Reporting a vulnerability
+
+Report suspected vulnerabilities privately via GitHub's private vulnerability
+reporting: <https://github.com/lan17/DialCache/security/advisories/new>.
+Do not open a public issue for a suspected vulnerability. You will receive an
+initial response within 7 days.
+
+## Trust model
+
+- DialCache treats the backing Redis/Valkey deployment as **trusted**. Cached
+  values are deserialized with `JSON.parse` and returned without runtime shape
+  validation or size limits, so an actor with write access to Redis controls
+  the objects returned to callers. Do not point DialCache at an untrusted
+  Redis.
+- Cache key components (`namespace`, `keyType`, ids, `useCase`, args) are
+  URL-encoded before key assembly, so ids cannot inject key delimiters, collide
+  across namespaces, or redirect cluster hash slots. Lua scripts are static
+  source; dynamic data reaches them only through `KEYS`/`ARGV`.
+- `namespace`, `keyType`, and `useCase` are emitted as metrics label values
+  unsanitized. Keep them developer-defined constants; never derive them from
+  user input.
+- DialCache never handles Redis credentials — clients are constructed and
+  owned by the caller.