diff --git a/.github/workflows/ci-latest-helm-chart-release.yaml b/.github/workflows/ci-latest-helm-chart-release.yaml
index 835ec644d0..b11bd6b2c6 100644
--- a/.github/workflows/ci-latest-helm-chart-release.yaml
+++ b/.github/workflows/ci-latest-helm-chart-release.yaml
@@ -7,6 +7,9 @@ on:
     paths:
       - "deployments/helm/**"
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   publish-chart:
     name: Update Stable Helm Chart With Latest Changes
diff --git a/.github/workflows/ci-latest-release.yml b/.github/workflows/ci-latest-release.yml
index bb0182025a..911b58c795 100644
--- a/.github/workflows/ci-latest-release.yml
+++ b/.github/workflows/ci-latest-release.yml
@@ -16,6 +16,9 @@ on:
     branches:
       - "v*"
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   check:
     name: Check what pkg were updated
diff --git a/.github/workflows/ci-operator-release.yaml b/.github/workflows/ci-operator-release.yaml
index 6cd6e55f7a..9a58f61655 100644
--- a/.github/workflows/ci-operator-release.yaml
+++ b/.github/workflows/ci-operator-release.yaml
@@ -14,6 +14,8 @@ on:
     branches:
       - "v*"
 
+# Declare default permissions as read only.
+permissions: read-all
 
 env:
   PLATFORM: linux/amd64,linux/arm64/v8
diff --git a/.github/workflows/ci-stable-release.yml b/.github/workflows/ci-stable-release.yml
index 2a14b4c57a..5f764ef5fc 100644
--- a/.github/workflows/ci-stable-release.yml
+++ b/.github/workflows/ci-stable-release.yml
@@ -5,7 +5,9 @@ on:
     branches: [main]
     paths:
       - "STABLE-RELEASE"
-    #  - ".github/workflows/ci-stable-release.yml"
+
+# Declare default permissions as read only.
+permissions: read-all
 
 jobs:
   push-stable-version:
diff --git a/.github/workflows/ci-systemd-release.yml b/.github/workflows/ci-systemd-release.yml
index a95a65391d..67921f1d48 100644
--- a/.github/workflows/ci-systemd-release.yml
+++ b/.github/workflows/ci-systemd-release.yml
@@ -5,8 +5,8 @@ on:
     tags:
       - "*"
 
-permissions:
-  contents: write
+# Declare default permissions as read only.
+permissions: read-all
 
 jobs:
   goreleaser:
@@ -33,6 +33,8 @@ jobs:
 
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v2
+        permissions:
+          contents: write
         with:
           distribution: goreleaser
           version: v1.12.2
diff --git a/.github/workflows/ci-test-controllers.yml b/.github/workflows/ci-test-controllers.yml
index 4650e71766..47729b35ab 100644
--- a/.github/workflows/ci-test-controllers.yml
+++ b/.github/workflows/ci-test-controllers.yml
@@ -8,6 +8,9 @@ on:
       - "pkg/**"
       - ".github/workflows/ci-test-controllers.yml"
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   kubearmor-controller-test:
     name: Build and Test KubeArmorController Using Ginkgo
@@ -43,7 +46,7 @@ jobs:
         run: |
           go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo
           make -C tests/k8s_env/
-        timeout-minutes: 20
+        timeout-minutes: 30
 
       - name: Get karmor sysdump
         if: ${{ failure() }}
diff --git a/.github/workflows/ci-test-ginkgo.yml b/.github/workflows/ci-test-ginkgo.yml
index e294482947..e4e33286c3 100644
--- a/.github/workflows/ci-test-ginkgo.yml
+++ b/.github/workflows/ci-test-ginkgo.yml
@@ -19,6 +19,10 @@ on:
       - ".github/workflows/ci-test-ginkgo.yml"
       - "pkg/KubeArmorOperator/**"
       - "deployments/helm/**"
+
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   build:
     name: Auto-testing Framework / ${{ matrix.os }} / ${{ matrix.runtime }}
diff --git a/.github/workflows/ci-test-go.yml b/.github/workflows/ci-test-go.yml
index f99db7b273..4ee44f1934 100644
--- a/.github/workflows/ci-test-go.yml
+++ b/.github/workflows/ci-test-go.yml
@@ -3,8 +3,23 @@ name: ci-test-go
 on:
   push:
     branches: [main]
+    paths:
+      - "KubeArmor/**"
+      - "tests/**"
+      - "protobuf/**"
+      - ".github/workflows/ci-test-go.yml"
+      - "pkg/KubeArmorOperator/**"
   pull_request:
     branches: [main]
+    paths:
+      - "KubeArmor/**"
+      - "tests/**"
+      - "protobuf/**"
+      - ".github/workflows/ci-test-go.yml"
+      - "pkg/KubeArmorOperator/**"
+    
+# Declare default permissions as read only.
+permissions: read-all
 
 jobs:
   go-fmt:
diff --git a/.github/workflows/ci-test-helm-charts.yml b/.github/workflows/ci-test-helm-charts.yml
index a1166177cd..18d54b4db4 100644
--- a/.github/workflows/ci-test-helm-charts.yml
+++ b/.github/workflows/ci-test-helm-charts.yml
@@ -12,6 +12,9 @@ on:
       - "deployments/helm/**"
       - ".github/workflows/ci-test-helm-charts.yml"
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   lint:
     name: Helm Chart Tests / ubuntu 20.04
diff --git a/.github/workflows/ci-test-operator.yaml b/.github/workflows/ci-test-operator.yaml
index 2965cdfd11..e4030b2892 100644
--- a/.github/workflows/ci-test-operator.yaml
+++ b/.github/workflows/ci-test-operator.yaml
@@ -17,6 +17,9 @@ on:
       - "deployments/**"
       - "KubeArmor/utils/**"
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   kubearmor-operator-test:
     name: Build KubeArmor Operator
diff --git a/.github/workflows/ci-test-systemd.yml b/.github/workflows/ci-test-systemd.yml
index aeabc0e377..fa3035dda1 100644
--- a/.github/workflows/ci-test-systemd.yml
+++ b/.github/workflows/ci-test-systemd.yml
@@ -16,6 +16,9 @@ on:
       - "protobuf/**"
       - ".github/workflows/ci-test-systemd.yml"
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   build:
     name: Test KubeArmor in Systemd Mode
diff --git a/.github/workflows/ci-test-ubi-image.yml b/.github/workflows/ci-test-ubi-image.yml
index 98cb7b4431..a40f6c766d 100644
--- a/.github/workflows/ci-test-ubi-image.yml
+++ b/.github/workflows/ci-test-ubi-image.yml
@@ -16,6 +16,9 @@ on:
       - "protobuf/**"
       - ".github/workflows/ci-test-ginkgo.yml"
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   build:
     name: Auto-testing Framework / ${{ matrix.os }} / ${{ matrix.runtime }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000000..c9fce9cd71
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,52 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '30 17 * * 5'
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: 'ubuntu-latest'
+    timeout-minutes: 30
+    permissions:
+      # required for all workflows
+      security-events: write
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: 'go'
+
+    # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v3
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:go"
diff --git a/KubeArmor/BPF/libbpf b/KubeArmor/BPF/libbpf
index 20c0a9e3d7..67a4b14643 160000
--- a/KubeArmor/BPF/libbpf
+++ b/KubeArmor/BPF/libbpf
@@ -1 +1 @@
-Subproject commit 20c0a9e3d7e7d4aeb283eae982543c9cacc29477
+Subproject commit 67a4b1464349345e483df26ed93f8d388a60cee1