Add permissions to CI/CodeQL workflows, fix vulnerability badge 404

- ci.yml: add permissions { contents: read }
- codeql.yml: add contents: read alongside security-events: write
- Fix vulnerability badge label from "0 - clean" to "0" to avoid
  shields.io URL encoding issues causing 404

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: aksOps

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/codeql.yml

@@ -9,6 +9,7 @@ on:
     - cron: "0 6 * * 1"
 
 permissions:
+  contents: read
   security-events: write
 
 jobs:

README.md

@@ -19,7 +19,7 @@
   <a href="https://github.com/RandomCodeSpace/code-iq/security"><img src="https://img.shields.io/badge/security-audited-purple?style=flat-square&logo=shieldsdotio&logoColor=white" alt="Security"></a>
   <a href="https://github.com/RandomCodeSpace/code-iq/security/dependabot"><img src="https://img.shields.io/badge/dependabot-enabled-brightgreen?style=flat-square&logo=dependabot&logoColor=white" alt="Dependabot enabled"></a>
   <a href="https://github.com/RandomCodeSpace/code-iq/security/code-scanning"><img src="https://img.shields.io/github/actions/workflow/status/RandomCodeSpace/code-iq/codeql.yml?branch=main&style=flat-square&logo=github&label=CodeQL" alt="CodeQL"></a>
-  <!-- DYNAMIC:vulnerabilities --><a href="https://github.com/RandomCodeSpace/code-iq/security/dependabot"><img src="https://img.shields.io/badge/vulnerabilities-0%20-%20clean-brightgreen?style=flat-square&logo=hackthebox&logoColor=white" alt="0 - clean Vulnerabilities"></a><!-- /DYNAMIC:vulnerabilities -->
+  <!-- DYNAMIC:vulnerabilities --><a href="https://github.com/RandomCodeSpace/code-iq/security/dependabot"><img src="https://img.shields.io/badge/vulnerabilities-0-brightgreen?style=flat-square&logo=hackthebox&logoColor=white" alt="0 Vulnerabilities"></a><!-- /DYNAMIC:vulnerabilities -->
   <!-- DYNAMIC:detectors --><a href="https://github.com/RandomCodeSpace/code-iq"><img src="https://img.shields.io/badge/detectors-58-brightgreen?style=flat-square&logo=codefactor&logoColor=white" alt="58 Detectors"></a><!-- /DYNAMIC:detectors -->
   <!-- DYNAMIC:languages --><a href="https://github.com/RandomCodeSpace/code-iq"><img src="https://img.shields.io/badge/languages-33-blue?style=flat-square&logo=stackblitz&logoColor=white" alt="33 Languages"></a><!-- /DYNAMIC:languages -->
   <!-- DYNAMIC:tests --><a href="https://github.com/RandomCodeSpace/code-iq"><img src="https://img.shields.io/badge/tests-113%20passed-brightgreen?style=flat-square&logo=pytest&logoColor=white" alt="113 passed Tests"></a><!-- /DYNAMIC:tests -->

scripts/update_readme_badges.py

@@ -135,7 +135,7 @@ def main() -> None:
     )
     if vulns >= 0:
         vuln_color = "brightgreen" if vulns == 0 else "yellow" if vulns <= 3 else "red"
-        vuln_label = "0 - clean" if vulns == 0 else str(vulns)
+        vuln_label = "0" if vulns == 0 else str(vulns)
         content = update_badge(
             content, "vulnerabilities",
             badge("vulnerabilities", vuln_label, vuln_color, "hackthebox"),