diff --git a/.github/workflows/blossom-ci.yml b/.github/workflows/blossom-ci.yml
index a564e2e27f..6b0c736ff4 100644
--- a/.github/workflows/blossom-ci.yml
+++ b/.github/workflows/blossom-ci.yml
@@ -13,12 +13,8 @@ on:
             required: false
 
 permissions:
-  actions: write
-  checks: write
-  contents: write
-  issues: write
-  pull-requests: write
-  repository-projects: write
+  contents: read
+  pull-requests: read
   statuses: write
 
 jobs:
@@ -54,7 +50,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           repository: ${{ fromJson(needs.Authorization.outputs.args).repo }}
-          ref: ${{ fromJson(needs.Authorization.outputs.args).ref }}
+          ref: ${{ fromJson(needs.Authorization.outputs.args).sha }}
           lfs: 'true'
 
       # repo specific steps
diff --git a/.github/workflows/build_docs.yml b/.github/workflows/build_docs.yml
index aeb2b8a299..8d0d26d99a 100644
--- a/.github/workflows/build_docs.yml
+++ b/.github/workflows/build_docs.yml
@@ -12,6 +12,9 @@ on:
       - main
       - releasing/*
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: build-docs-${{ github.event.pull_request.number || github.ref }}
diff --git a/.github/workflows/chatops.yml b/.github/workflows/chatops.yml
index 41b7a2e158..85336b7999 100644
--- a/.github/workflows/chatops.yml
+++ b/.github/workflows/chatops.yml
@@ -1,6 +1,9 @@
 # triggering the workflows by commenting `/black` and `/integration-test`
 name: chatops
 
+permissions:
+  contents: read
+
 # currently dispatches /black command to project-monai/monai-code-formatter
 on:
   issue_comment:
diff --git a/.github/workflows/cicd_tests.yml b/.github/workflows/cicd_tests.yml
index e9b207951f..cb65c7e3e2 100644
--- a/.github/workflows/cicd_tests.yml
+++ b/.github/workflows/cicd_tests.yml
@@ -21,6 +21,9 @@ on:
       - '**.rst'
       - 'docs/**'
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: cicd-tests-${{ github.event.pull_request.number || github.ref }}
diff --git a/.github/workflows/conda.yml b/.github/workflows/conda.yml
index 9cb72ab9a4..208a133d49 100644
--- a/.github/workflows/conda.yml
+++ b/.github/workflows/conda.yml
@@ -7,6 +7,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: conda-tests-${{ github.event.pull_request.number || github.ref }}
diff --git a/.github/workflows/cron-ngc-bundle.yml b/.github/workflows/cron-ngc-bundle.yml
index 650434eb37..1421e1dfc1 100644
--- a/.github/workflows/cron-ngc-bundle.yml
+++ b/.github/workflows/cron-ngc-bundle.yml
@@ -7,6 +7,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: bundle-tests-${{ github.event.pull_request.number || github.ref }}
diff --git a/.github/workflows/cron.yml b/.github/workflows/cron.yml
index 9a01b346e5..455d2b3cf5 100644
--- a/.github/workflows/cron.yml
+++ b/.github/workflows/cron.yml
@@ -7,6 +7,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   cron-gpu:
     if: github.repository == 'Project-MONAI/MONAI'
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 921d8f5c89..0813a20b3e 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -13,6 +13,9 @@ on:
   # This is to trigger building/testing docker image from dev only.
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   versioning_dev:
     # compute versioning file from python setup.py
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index d3c1e473c7..81d4729c32 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -5,6 +5,9 @@ on:
   repository_dispatch:
     type: [integration-test-command]
 
+permissions:
+  contents: read
+
 jobs:
   integration-auto3dseg:
     container:
diff --git a/.github/workflows/pythonapp-gpu.yml b/.github/workflows/pythonapp-gpu.yml
index 8378d2742a..bc7c510713 100644
--- a/.github/workflows/pythonapp-gpu.yml
+++ b/.github/workflows/pythonapp-gpu.yml
@@ -12,6 +12,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: build-gpu-${{ github.event.pull_request.number || github.ref }}
diff --git a/.github/workflows/pythonapp-hyena-gpu.yml b/.github/workflows/pythonapp-hyena-gpu.yml
index b080942bf3..f30d8c8ba0 100644
--- a/.github/workflows/pythonapp-hyena-gpu.yml
+++ b/.github/workflows/pythonapp-hyena-gpu.yml
@@ -22,6 +22,9 @@ name: hyena-gpu
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: hyena-gpu-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d4c55e1f08..2df2079c7d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,6 +8,9 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: read
+
 jobs:
   packaging:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/setupapp.yml b/.github/workflows/setupapp.yml
index d7bf1dc6dd..cb1dda6823 100644
--- a/.github/workflows/setupapp.yml
+++ b/.github/workflows/setupapp.yml
@@ -13,6 +13,9 @@ on:
     # Allows you to run this workflow manually from the Actions tab
     workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: deploy-${{ github.event.pull_request.number || github.ref }}
diff --git a/monai/apps/utils.py b/monai/apps/utils.py
index 57cc7b18a4..b15b0c1969 100644
--- a/monai/apps/utils.py
+++ b/monai/apps/utils.py
@@ -378,7 +378,7 @@ def get_filename_from_url(data_url: str) -> str:
             filename = re.findall('filename="?([^";]+)"?', content_disposition)
             if filename:
                 return str(filename[0])
-        if "drive.google.com" in data_url:
+        if urlparse(data_url).netloc == "drive.google.com":
             response = requests.get(data_url)
             if "text/html" in response.headers.get("Content-Type", ""):
                 soup = BeautifulSoup(response.text, "html.parser")