[rubenvdlinde]

What

Licensing, secret scanning and supply-chain hygiene in one change.

• SPDX licence headers: 99.84% -> 100% of 1251 tracked source files carry an SPDX-License-Identifier in their first 30 lines or are covered by REUSE metadata. New headers follow the style the repository already uses, with the year the file was first committed. Translation catalogues (and generated files, where there are any) are covered by REUSE.toml.
• Licence declarations: LICENSE, package.json, composer.json, publiccode.yml and appinfo/info.xml all declare EUPL-1.2; nothing to change.
• Committed secrets: gitleaks dir found no real secrets. The findings are test fixtures, seed slugs and the documented admin:admin login of the local development container; .gitleaks.toml keeps the default rules and adds 7 allowlists, each naming exact files, only the rules that fire there, and the reason.
• OpenSSF Scorecard: adds .github/workflows/scorecard.yml (publish_results, every action pinned by commit SHA, read-only default token, job-level write only for SARIF upload and the OIDC token). It runs from main once hosted Actions is back. Every workflow now has a top-level permissions: block (read-only, with write grants moved to the jobs that need them).

Verified locally

• hydra diff check on the changed files: php -l, phpcs, phpstan, eslint and stylelint green; the gate runner reported nothing caused by these lines (anything inherited is named above).
• Maintainability floor compare against the merge base: no drop.
• gitleaks dir --redact (8.30.1): no leaks after the ignore list.
• Hosted CI is down, so this merges on local green into development.

AI disclosure: prepared with Claude Code (claude-opus-5-5) and reviewed before merge.