Changelog fa35c11 ci: use explicit least-privilege permission for workflow (#147) 770d490 fix: ensure blocked services in config is an empty list when unset (#145)