diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
deleted file mode 100644
index 688a442..0000000
--- a/.github/FUNDING.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-# Funding platforms for hyperpolymath projects
-# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
-
-github: hyperpolymath
-ko_fi: hyperpolymath
-liberapay: hyperpolymath
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0d60206..a803ba2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -41,12 +41,12 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v3
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v3
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 3d8f693..a2cd2ab 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -242,7 +242,7 @@ jobs:
           always() &&
           (github.event_name != 'pull_request' ||
            github.event.pull_request.head.repo.fork != true)
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v3.28.1
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v3.28.1
         with:
           sarif_file: hypatia.sarif
           # Distinct category so Hypatia results coexist with CodeQL's
diff --git a/.github/workflows/rescript-deno-ci.yml b/.github/workflows/rescript-deno-ci.yml
deleted file mode 100644
index c3063bf..0000000
--- a/.github/workflows/rescript-deno-ci.yml
+++ /dev/null
@@ -1,50 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-permissions:
-  contents: read
-
-name: Deno CI
-on:
-  push:
-    branches: [main, master]
-  pull_request:
-
-# Estate guardrail: scope push to default branches so a PR fires once (not
-# push+PR), and cancel superseded runs. Safe — read-only PR-triggered check.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2
-        with:
-          deno-version: v2.x
-
-      - name: Deno lint
-        run: deno task lint
-
-      - name: Deno fmt check
-        run: deno fmt --check tests/
-
-      - name: Deno test
-        run: deno test --allow-all --coverage=coverage
-
-      - name: Type check
-        run: deno check tests/**/*.js
-
-  security:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2
-      - name: Check permissions
-        run: |
-          # Audit for dangerous permissions
-          grep -rE "allow-run|allow-write|allow-env" . || echo "No dangerous permissions"
diff --git a/audits/assail-classifications.a2ml b/audits/assail-classifications.a2ml
index 458a29a..6a96efc 100644
--- a/audits/assail-classifications.a2ml
+++ b/audits/assail-classifications.a2ml
@@ -1,4 +1,8 @@
 %A2ML
+# SPDX-License-Identifier: MIT
+---
+version: 1.0
+project: bofig
 - suppression:
     file: 'assets/js/hooks/prompt_radar_hook.js'
     rule: 'DynamicCodeExecution'