diff --git a/.github/workflows/clang_tidy.yml b/.github/workflows/clang_tidy.yml
index 5bdb82b31..af4d076c1 100644
--- a/.github/workflows/clang_tidy.yml
+++ b/.github/workflows/clang_tidy.yml
@@ -8,10 +8,18 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-22.04
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: Checkout
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: "Tool: Clang 16"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index eac3241b8..3ab987829 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -8,6 +8,9 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
@@ -22,6 +25,11 @@ jobs:
       matrix:
         language: [ 'cpp' ]
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: Checkout repository
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: Initialize CodeQL
diff --git a/.github/workflows/cppcheck.yml b/.github/workflows/cppcheck.yml
index b95f78be5..2707d96dc 100644
--- a/.github/workflows/cppcheck.yml
+++ b/.github/workflows/cppcheck.yml
@@ -8,10 +8,18 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-22.04
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: Checkout
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: Install
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 000000000..9bfe6712e
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,27 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+        with:
+          egress-policy: audit
+
+      - name: 'Checkout Repository'
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1
diff --git a/.github/workflows/deploy_doxygen.yml b/.github/workflows/deploy_doxygen.yml
index 2dccbdb0e..566a27db2 100644
--- a/.github/workflows/deploy_doxygen.yml
+++ b/.github/workflows/deploy_doxygen.yml
@@ -6,10 +6,20 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
+    permissions:
+      contents: write  # for peaceiris/actions-gh-pages to push pages branch
     runs-on: ubuntu-20.04
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: Checkout
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: Doxygen
diff --git a/.github/workflows/deploy_test_coverage_coveralls.yml b/.github/workflows/deploy_test_coverage_coveralls.yml
index c1d30913c..e40dda653 100644
--- a/.github/workflows/deploy_test_coverage_coveralls.yml
+++ b/.github/workflows/deploy_test_coverage_coveralls.yml
@@ -8,10 +8,21 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
+    permissions:
+      checks: write  # for coverallsapp/github-action to create new checks
+      contents: read  # for actions/checkout to fetch code
     runs-on: ubuntu-22.04
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: Checkout
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: "Install"
diff --git a/.github/workflows/doxygen.yml b/.github/workflows/doxygen.yml
index f4eff05e9..c6f94053b 100644
--- a/.github/workflows/doxygen.yml
+++ b/.github/workflows/doxygen.yml
@@ -8,10 +8,18 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-20.04
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: Checkout
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: Doxygen
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 6d383659b..6025e1b5f 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -8,10 +8,18 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: "Checkout"
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: "Install"
diff --git a/.github/workflows/memory_valgrind.yml b/.github/workflows/memory_valgrind.yml
index fbbaad34e..06fda934e 100644
--- a/.github/workflows/memory_valgrind.yml
+++ b/.github/workflows/memory_valgrind.yml
@@ -8,10 +8,18 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-22.04
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: Checkout
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: Install
diff --git a/.github/workflows/openssf_scorecard.yml b/.github/workflows/openssf_scorecard.yml
index 306d91521..0bb647d87 100644
--- a/.github/workflows/openssf_scorecard.yml
+++ b/.github/workflows/openssf_scorecard.yml
@@ -15,6 +15,11 @@ jobs:
       security-events: write
       id-token: write
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+        with:
+          egress-policy: audit
+
       - name: "Checkout Code"
         uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
         with:
diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml
index ffdec7f01..833a0a90b 100644
--- a/.github/workflows/pipeline.yml
+++ b/.github/workflows/pipeline.yml
@@ -8,6 +8,9 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
@@ -23,6 +26,11 @@ jobs:
     name: "${{ matrix.os }} / ${{ matrix.compiler }} / ${{ matrix.generator }} / ${{ matrix.config }}"
     runs-on: "${{ matrix.os }}"
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: "Checkout"
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: "Tool: Microsoft Windows"
diff --git a/.github/workflows/sanitizer.yml b/.github/workflows/sanitizer.yml
index 22bebb176..15541265c 100644
--- a/.github/workflows/sanitizer.yml
+++ b/.github/workflows/sanitizer.yml
@@ -8,6 +8,9 @@ on:
   schedule:
   - cron: "0 0 * * */5"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
@@ -31,6 +34,11 @@ jobs:
     env:
       CXXFLAGS: "${{ matrix.sanitizer.cpp_flags }}"
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit
+
     - name: "Checkout"
       uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
     - name: "Configure"
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 000000000..ed0306233
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,18 @@
+repos:
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.16.3
+  hooks:
+  - id: gitleaks
+- repo: https://github.com/jumanjihouse/pre-commit-hooks
+  rev: 3.0.0
+  hooks:
+  - id: shellcheck
+- repo: https://github.com/pocc/pre-commit-hooks
+  rev: v1.3.5
+  hooks:
+  - id: cpplint
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.4.0
+  hooks:
+  - id: end-of-file-fixer
+  - id: trailing-whitespace