chore: fill or remove RSR template placeholders (#60)

`openssf-compliance.yml` fails when any of the thirteen files it checks
still contains a `{{PLACEHOLDER}}` token. This clears them, with no
invention.

- **Deleted** the `TEMPLATE INSTRUCTIONS (delete this block before
publishing)` comment — the template says to delete it, and it is where
every legend line lived, so a large share of the reported tokens were
the file documenting its own placeholders.
- **Filled** what the repository itself supplies: owner and repo from
the git remote, project name, year, forge, main branch, contact email.
- **Removed** PGP and website lines. `https://github.com/<user>.gpg`
returns HTTP 200 for every account; with no key uploaded the body is a
stub reading *"This user hasn't uploaded any GPG keys"*. No key is
published for either account, and commit signing here is SSH —
unrelated. The template sanctions this: *"Optional: Remove sections that
don't apply (e.g. PGP if you don't use it)."*\n\nA security policy
telling a researcher to encrypt to a key that does not exist is worse
than one that does not mention encryption.\n\n**Where applicable, this
also fixes a misrouted advisory URL.** A previous `just init` copied
already-filled templates out of `squisher-corpus`, so 51 repositories
directed vulnerability reports to `hyperpolymath/squisher-corpus` — a
repository unrelated to the code being reported, meaning the affected
maintainer never saw them. Repointed from this repository's own git
remote.

---------

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/GOVERNANCE.md

@@ -4,24 +4,6 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 -->
 # Security Policy
 
-<!-- 
-============================================================================
-TEMPLATE INSTRUCTIONS (delete this block before publishing)
-============================================================================
-Replace all {{PLACEHOLDER}} values with your information:
-  {{PROJECT_NAME}}     - Your project name
-  {{OWNER}}            - GitHub username or org (e.g., hyperpolymath)
-  {{REPO}}             - Repository name
-  {{SECURITY_EMAIL}}   - Security contact email
-  {{PGP_FINGERPRINT}}  - Your PGP key fingerprint (40 chars, no spaces)
-  {{PGP_KEY_URL}}      - URL to your public PGP key
-  {{WEBSITE}}          - Your website/domain
-  {{CURRENT_YEAR}}     - Current year for copyright
-
-Optional: Remove sections that don't apply (e.g., PGP if you don't use it)
-============================================================================
--->
-
 We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions.
 
 ## Table of Contents
@@ -44,7 +26,7 @@ We take security seriously. We appreciate your efforts to responsibly disclose v
 
 The preferred method for reporting security vulnerabilities is through GitHub's Security Advisory feature:
 
-1. Navigate to [Report a Vulnerability](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new)
+1. Navigate to [Report a Vulnerability](https://github.com/hyperpolymath/natsci-studio/security/advisories/new)
 2. Click **"Report a vulnerability"**
 3. Complete the form with as much detail as possible
 4. Submit — we'll receive a private notification
@@ -62,20 +44,8 @@ If you cannot use GitHub Security Advisories, you may email us directly:
 
 | | |
 |---|---|
-| **Email** | {{SECURITY_EMAIL}} |
-| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) |
-| **Fingerprint** | `{{PGP_FINGERPRINT}}` |
-
-```bash
-# Import our PGP key
-curl -sSL {{PGP_KEY_URL}} | gpg --import
+| **Email** | jonathan.jewell@gmail.com |
 
-# Verify fingerprint
-gpg --fingerprint {{SECURITY_EMAIL}}
-
-# Encrypt your report
-gpg --armor --encrypt --recipient {{SECURITY_EMAIL}} report.txt
-```
 
 > **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media.
 
@@ -207,7 +177,7 @@ If we cannot reach agreement on disclosure timing, we default to 90 days from yo
 
 The following are within scope for security research:
 
-- This repository (`{{OWNER}}/{{REPO}}`) and all its code
+- This repository (`hyperpolymath/natsci-studio`) and all its code
 - Official releases and packages published from this repository
 - Documentation that could lead to security issues
 - Build and deployment configurations in this repository
@@ -326,7 +296,7 @@ Recognition includes:
 To stay informed about security updates:
 
 - **Watch this repository**: Click "Watch" → "Custom" → Select "Security alerts"
-- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories)
+- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/hyperpolymath/natsci-studio/security/advisories)
 - **Release notes**: Security fixes noted in [CHANGELOG](CHANGELOG.md)
 
 ### Update Policy
@@ -352,7 +322,7 @@ To stay informed about security updates:
 
 ## Security Best Practices
 
-When using {{PROJECT_NAME}}, we recommend:
+When using natsci-studio, we recommend:
 
 ### General
 
@@ -374,8 +344,7 @@ When using {{PROJECT_NAME}}, we recommend:
 
 ## Additional Resources
 
-- [Our PGP Public Key]({{PGP_KEY_URL}})
-- [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories)
+- [Security Advisories](https://github.com/hyperpolymath/natsci-studio/security/advisories)
 - [Changelog](CHANGELOG.md)
 - [Contributing Guidelines](CONTRIBUTING.md)
 - [CVE Database](https://cve.mitre.org/)
@@ -387,8 +356,8 @@ When using {{PROJECT_NAME}}, we recommend:
 
 | Purpose | Contact |
 |---------|---------|
-| **Security issues** | [Report via GitHub](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) or {{SECURITY_EMAIL}} |
-| **General questions** | [GitHub Discussions](https://github.com/{{OWNER}}/{{REPO}}/discussions) |
+| **Security issues** | [Report via GitHub](https://github.com/hyperpolymath/natsci-studio/security/advisories/new) or jonathan.jewell@gmail.com |
+| **General questions** | [GitHub Discussions](https://github.com/hyperpolymath/natsci-studio/discussions) |
 | **Other enquiries** | See [README](README.md) for contact information |
 
 ---
@@ -403,8 +372,8 @@ This security policy may be updated from time to time. Significant changes will
 
 ---
 
-*Thank you for helping keep {{PROJECT_NAME}} and its users safe.* 🛡️
+*Thank you for helping keep natsci-studio and its users safe.* 🛡️
 
 ---
 
-<sub>Last updated: {{CURRENT_YEAR}} · Policy version: 1.0.0</sub>
+<sub>Last updated: 2026 · Policy version: 1.0.0</sub>

.github/SECURITY.md

@@ -13,6 +13,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 jobs:
   trigger-boj:

.github/workflows/boj-build.yml

@@ -18,6 +18,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
 jobs:
   analyze:
@@ -37,11 +38,11 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
+        uses: github/codeql-action/init@29b1f65c1f735799893313399435a59f54045865 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
+        uses: github/codeql-action/analyze@29b1f65c1f735799893313399435a59f54045865 # v3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/codeql.yml

@@ -41,6 +41,7 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 permissions:
+  actions: read
   contents: write # needed to enable auto-merge
   pull-requests: write # needed to approve
   # NB: keep narrow — do NOT add secrets: read or id-token: write here.

.github/workflows/dependabot-automerge.yml

@@ -11,6 +11,7 @@ on:
   push:
     branches: [main, master]
 permissions:
+  actions: read
   contents: read
 jobs:
   # ---------------------------------------------------------------------------

.github/workflows/dogfood-gate.yml

@@ -29,6 +29,7 @@ on:
       - 'tests/**'
   workflow_dispatch:
 permissions: read-all
+  actions: read
 concurrency:
   group: e2e-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/e2e.yml

@@ -9,6 +9,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/governance.yml

@@ -11,6 +11,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   security-events: write
 

.github/workflows/hypatia-scan.yml

@@ -9,6 +9,7 @@ on:
   release:
     types: [published]
 permissions:
+  actions: read
   contents: read
 jobs:
   dispatch: