diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index 6dc315b..71dfbc0 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -7,6 +7,10 @@ on:
 jobs:
     coverage:
         runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            checks: write
+            pull-requests: write
         steps:
             - uses: actions/checkout@v3
             - uses: ArtiomTr/jest-coverage-report-action@v2
diff --git a/test/contentstack-core.spec.ts b/test/contentstack-core.spec.ts
index abd0e7b..3b710e2 100644
--- a/test/contentstack-core.spec.ts
+++ b/test/contentstack-core.spec.ts
@@ -104,6 +104,7 @@ describe('contentstackCore', () => {
     it('should include apiKey in headers when provided', () => {
       const options = {
         apiKey: 'my-api-key',
+        // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
         accessToken: 'my-access-token',
         insecure: true,
         defaultHostname: 'example.com',
@@ -117,6 +118,7 @@ describe('contentstackCore', () => {
       expect(instance.defaults.headers).toEqual(
         expect.objectContaining({
           api_key: 'my-api-key',
+          // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
           access_token: 'my-access-token',
         })
       );
@@ -125,6 +127,7 @@ describe('contentstackCore', () => {
     it('should include accessToken in headers when provided', () => {
       const options = {
         apiKey: 'my-api-key',
+        // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
         accessToken: 'my-access-token',
         insecure: false,
         defaultHostname: 'example.com',
@@ -138,6 +141,7 @@ describe('contentstackCore', () => {
       expect(instance.defaults.headers).toEqual(
         expect.objectContaining({
           api_key: 'my-api-key',
+          // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
           access_token: 'my-access-token',
         })
       );
diff --git a/test/contentstack-error.spec.ts b/test/contentstack-error.spec.ts
index 47e88d9..07030d7 100644
--- a/test/contentstack-error.spec.ts
+++ b/test/contentstack-error.spec.ts
@@ -26,6 +26,7 @@ describe('Contentstack Error', () => {
         data: {
           name: 'John Doe',
           email: 'johndoe@example.com',
+          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
           password: 'password123',
         },
         headers: {
@@ -92,6 +93,7 @@ describe('Contentstack Error', () => {
         data: {
           name: "John Doe",
           email: "johndoe@example.com",
+          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
           password: "password123",
         },
         headers: {
diff --git a/test/request.spec.ts b/test/request.spec.ts
index 3fca0b7..a8d106d 100644
--- a/test/request.spec.ts
+++ b/test/request.spec.ts
@@ -181,6 +181,7 @@ describe('Request tests', () => {
 
     client.stackConfig = {
       // live_preview not defined
+      // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
       apiKey: 'test-key',
     };
 
diff --git a/test/utils/mocks.ts b/test/utils/mocks.ts
index d12054c..9f6b3f9 100644
--- a/test/utils/mocks.ts
+++ b/test/utils/mocks.ts
@@ -8,6 +8,7 @@ const mockErrorResponse = {
     data: {
       name: "John Doe",
       email: "johndoe@example.com",
+      // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
       password: "password123",
     },
     headers: {
@@ -36,6 +37,7 @@ const mockErrorResponseWithoutErrorData = {
     data: {
       name: "John Doe",
       email: "johndoe@example.com",
+      // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
       password: "password123",
     },
     headers: {
@@ -70,6 +72,7 @@ const mockErrorResponseNoData = {
     data: {
       name: "John Doe",
       email: "johndoe@example.com",
+      // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
       password: "password123",
     },
     headers: {