CI workflows default to write-all permissions, and a couple of compose files are worth a second look

[jkondrat]

Issue	Where	Why it matters
No explicit least-privilege permissions: block	.github/workflows/github-labeler.yml, platform-docker-build-test-publish.yml, and about a dozen other workflows	Workflows default to broad write access to the repo instead of only what each job needs
Basic Auth credential pattern flagged	docker-compose.yml:9, docker-compose.pgpool.yml:25	Probably local dev defaults, worth a quick look to confirm nothing real is committed here

Suggested fix for the workflows, add a scoped block near the top:

permissions:
  contents: read

Then widen only the specific jobs that need more, like pull-requests: write for the labeler.

Found this with InfraScan (https://github.com/SolDevelo/InfraScan), an open-source cost/security scanner covering Terraform, Kubernetes, Helm, CloudFormation, Ansible, and containers (Apache-2.0). If it's useful, it's a few lines to add as a GitHub Action (https://github.com/marketplace/actions/infrascan-iac-cost-security-scanner). Happy to open a PR wiring it up if you want.