diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index e4b21be..4fa8267 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -12,7 +12,7 @@ on:
   schedule:
     - cron: '44 20 * * 4' # 20:44 UTC every Thursday; first-week check is in the job condition
   push:
-    branches: [ "main" ]
+    branches: [ main ]
 
 # Declare default permissions as read only.
 permissions: read-all
@@ -31,9 +31,13 @@ jobs:
       security-events: write
       # Needed to publish results and get a badge (see publish_results below).
       id-token: write
-      # Uncomment the permissions below if installing in a private repository.
+      # Uncomment the reads below if this repository becomes private: upstream
+      # recommends them to avoid GraphQL and SAST gaps. A public repository
+      # needs neither, which is why ossf/scorecard's own workflow omits them.
       # contents: read
-      # actions: read
+      # issues: read
+      # pull-requests: read
+      # checks: read
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -55,6 +59,10 @@ jobs:
           # - you want to enable the Branch-Protection check on a *public* repository, or
           # - you are installing Scorecard on a *private* repository
           # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+          # Deliberately left commented: main is protected by repository
+          # rulesets, not classic branch protection, and the default
+          # GITHUB_TOKEN can read those. A PAT would only add an annual
+          # rotation and a secret with admin-read scope.
           # repo_token: ${{ secrets.SCORECARD_TOKEN }}
 
           # Public repositories:
diff --git a/.idea/go.imports.xml b/.idea/go.imports.xml
new file mode 100644
index 0000000..644cdf0
--- /dev/null
+++ b/.idea/go.imports.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="GoImports">
+    <option name="excludedPackages">
+      <array>
+        <option value="golang.org/x/net/context" />
+      </array>
+    </option>
+  </component>
+</project>
\ No newline at end of file