diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index ae64b5e..34ae58e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -33,13 +33,13 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@29b1f65c1f735799893313399435a59f54045865 # v3
+        uses: github/codeql-action/init@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@29b1f65c1f735799893313399435a59f54045865 # v3
+        uses: github/codeql-action/autobuild@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@29b1f65c1f735799893313399435a59f54045865 # v3
+        uses: github/codeql-action/analyze@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
diff --git a/SECURITY.md b/SECURITY.md
index a96a34c..72c41c2 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,5 +1,19 @@
 # Security Policy
 
+TEMPLATE INSTRUCTIONS (delete this block before publishing)
+Replace all {{PLACEHOLDER}} values with your information:
+  Squisher Corpus     - Your project name
+  hyperpolymath            - GitHub username or org (e.g., hyperpolymath)
+  squisher-corpus             - Repository name
+  j.d.a.jewell@open.ac.uk   - Security contact email
+  TBD  - Your PGP key fingerprint (40 chars, no spaces)
+  https://github.com/hyperpolymath.gpg      - URL to your public PGP key
+  github.com/hyperpolymath/squisher-corpus          - Your website/domain
+  2026     - Current year for copyright
+
+Optional: Remove sections that don't apply (e.g., PGP if you don't use it)
+-->
+
 We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions.
 
 ## Table of Contents