CI workflows default to write-all permissions, and a couple of compose files are worth a second look

| Issue | Where | Why it matters |
|---|---|---|
| No explicit least-privilege `permissions:` block | `.github/workflows/github-labeler.yml`, `platform-docker-build-test-publish.yml`, and about a dozen other workflows | Workflows default to broad write access to the repo instead of only what each job needs |
| Basic Auth credential pattern flagged | `docker-compose.yml:9`, `docker-compose.pgpool.yml:25` | Probably local dev defaults, worth a quick look to confirm nothing real is committed here |

Suggested fix for the workflows, add a scoped block near the top:

```yaml
permissions:
contents: read
```

Then widen only the specific jobs that need more, like `pull-requests: write` for the labeler.

Found this with InfraScan (https://github.com/SolDevelo/InfraScan), an open-source cost/security scanner covering Terraform, Kubernetes, Helm, CloudFormation, Ansible, and containers (Apache-2.0). If it's useful, it's a few lines to add as a GitHub Action (https://github.com/marketplace/actions/infrascan-iac-cost-security-scanner). Happy to open a PR wiring it up if you want.

Start with .github/workflows/github-labeler.yml and platform-docker-build-test-publish.yml, then review the other workflows for their required permissions. Check docker-compose.yml:9 and docker-compose.pgpool.yml:25 to confirm the flagged credentials are only local defaults. Done means workflows use least-privilege permissions with necessary job-specific exceptions and no real credentials are committed.

Written by the indexing model from the issue text.