diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0a1d6dec4f..080f4115ea 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,3 +1,4 @@
+---
 name: Build
 
 on:
@@ -7,10 +8,11 @@ on:
 
 jobs:
   cloc:
+    name: CLOC
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f  # v2.3.4
 
       - name: Set up cloc
         run: |
@@ -24,11 +26,11 @@ jobs:
     name: Build CLI
     runs-on: windows-latest
     env:
-      WIN_PKG_FETCH_VERSION: 14.17.0
-      WIN_PKG_VERSION: 3.1
+      _WIN_PKG_FETCH_VERSION: 14.17.0
+      _WIN_PKG_VERSION: 3.1
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f  # v2.3.4
 
       - name: Setup Windows builder
         run: |
@@ -36,7 +38,7 @@ jobs:
           choco install reshack --no-progress
 
       - name: Set up Node
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e  # v1.4.6
         with:
           node-version: '14.x'
 
@@ -54,11 +56,11 @@ jobs:
         shell: pwsh
         run: |
           cd $HOME
-          $fetchedUrl = "https://github.com/vercel/pkg-fetch/releases/download/v$env:WIN_PKG_VERSION/node-v$env:WIN_PKG_FETCH_VERSION-win-x64"
+          $fetchedUrl = "https://github.com/vercel/pkg-fetch/releases/download/v$env:_WIN_PKG_VERSION/node-v$env:_WIN_PKG_FETCH_VERSION-win-x64"
 
           New-Item -ItemType directory -Path .\.pkg-cache
-          New-Item -ItemType directory -Path .\.pkg-cache\v$env:WIN_PKG_VERSION
-          Invoke-RestMethod -Uri $fetchedUrl -OutFile ".\.pkg-cache\v$env:WIN_PKG_VERSION\fetched-v$env:WIN_PKG_FETCH_VERSION-win-x64"
+          New-Item -ItemType directory -Path .\.pkg-cache\v$env:_WIN_PKG_VERSION
+          Invoke-RestMethod -Uri $fetchedUrl -OutFile ".\.pkg-cache\v$env:_WIN_PKG_VERSION\fetched-v$env:_WIN_PKG_FETCH_VERSION-win-x64"
 
       - name: Setup Version Info
         shell: pwsh
@@ -69,8 +71,8 @@ jobs:
         shell: cmd
         run: |
           set PATH=%PATH%;C:\Program Files (x86)\Resource Hacker
-          set WIN_PKG=C:\Users\runneradmin\.pkg-cache\v%WIN_PKG_VERSION%\fetched-v%WIN_PKG_FETCH_VERSION%-win-x64
-          set WIN_PKG_BUILT=C:\Users\runneradmin\.pkg-cache\v%WIN_PKG_VERSION%\built-v%WIN_PKG_FETCH_VERSION%-win-x64
+          set WIN_PKG=C:\Users\runneradmin\.pkg-cache\v%_WIN_PKG_VERSION%\fetched-v%_WIN_PKG_FETCH_VERSION%-win-x64
+          set WIN_PKG_BUILT=C:\Users\runneradmin\.pkg-cache\v%_WIN_PKG_VERSION%\built-v%_WIN_PKG_FETCH_VERSION%-win-x64
 
           copy %WIN_PKG% %WIN_PKG_BUILT%
           ResourceHacker -open %WIN_PKG_BUILT% -save %WIN_PKG_BUILT% -action delete -mask ICONGROUP,1,
@@ -124,44 +126,44 @@ jobs:
             -t sha256 | Out-File -Encoding ASCII ./dist/bw-linux-sha256-${env:PACKAGE_VERSION}.txt
 
       - name: Upload windows zip asset
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@27121b0bdffd731efa15d66772be8dc71245d074  # v2.2.4
         with:
           name: bw-windows-${{ env.PACKAGE_VERSION }}.zip
           path: ./dist/bw-windows-${{ env.PACKAGE_VERSION }}.zip
 
       - name: Upload windows checksum asset
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@27121b0bdffd731efa15d66772be8dc71245d074  # v2.2.4
         with:
           name: bw-windows-sha256-${{ env.PACKAGE_VERSION }}.txt
           path: ./dist/bw-windows-sha256-${{ env.PACKAGE_VERSION }}.txt
 
       - name: Upload macos zip asset
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@27121b0bdffd731efa15d66772be8dc71245d074  # v2.2.4
         with:
           name: bw-macos-${{ env.PACKAGE_VERSION }}.zip
           path: ./dist/bw-macos-${{ env.PACKAGE_VERSION }}.zip
 
       - name: Upload macos checksum asset
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@27121b0bdffd731efa15d66772be8dc71245d074  # v2.2.4
         with:
           name: bw-macos-sha256-${{ env.PACKAGE_VERSION }}.txt
           path: ./dist/bw-macos-sha256-${{ env.PACKAGE_VERSION }}.txt
 
       - name: Upload linux zip asset
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@27121b0bdffd731efa15d66772be8dc71245d074  # v2.2.4
         with:
           name: bw-linux-${{ env.PACKAGE_VERSION }}.zip
           path: ./dist/bw-linux-${{ env.PACKAGE_VERSION }}.zip
 
       - name: Upload linux checksum asset
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@27121b0bdffd731efa15d66772be8dc71245d074  # v2.2.4
         with:
           name: bw-linux-sha256-${{ env.PACKAGE_VERSION }}.txt
           path: ./dist/bw-linux-sha256-${{ env.PACKAGE_VERSION }}.txt
 
       - name: Upload Chocolatey asset
-        uses: actions/upload-artifact@v2
-        with: 
+        uses: actions/upload-artifact@27121b0bdffd731efa15d66772be8dc71245d074  # v2.2.4
+        with:
           name: bitwarden-cli.${{ env.PACKAGE_VERSION }}.nupkg
           path: ./dist/chocolatey/bitwarden-cli.${{ env.PACKAGE_VERSION }}.nupkg
 
@@ -172,7 +174,7 @@ jobs:
     needs: cli
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f  # v2.3.4
 
       - name: Set PACKAGE_VERSION
         shell: pwsh
@@ -186,12 +188,9 @@ jobs:
           echo "GitHub ref: $GITHUB_REF"
           echo "GitHub event: $GITHUB_EVENT"
           echo "BW Package Version: $PACKAGE_VERSION"
-        env:
-          GITHUB_REF: ${{ github.ref }}
-          GITHUB_EVENT: ${{ github.event_name }}
 
       - name: Get bw linux cli
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@3be87be14a055c47b01d3bd88f8fe02320a9bb60  # v2.0.10
         with:
           name: bw-linux-${{ env.PACKAGE_VERSION }}.zip
           path: ./dist/snap
@@ -200,7 +199,7 @@ jobs:
         run: |
           cp -r stores/snap/* -t dist/snap
           sed -i s/__version__/${{ env.PACKAGE_VERSION }}/g dist/snap/snapcraft.yaml
-          
+
           cd dist/snap
           ls -alth
 
@@ -215,7 +214,7 @@ jobs:
           ls -alth
           sha256sum bw_${{ env.PACKAGE_VERSION }}_amd64.snap | awk '{split($0, a); print a[1]}' > bw-snap-sha256-${{ env.PACKAGE_VERSION }}.txt
 
-      - name: Install Snap 
+      - name: Install Snap
         run: sudo snap install dist/snap/bw*.snap --dangerous
 
       - name: Test Snap
@@ -234,13 +233,13 @@ jobs:
           sudo snap remove bw
 
       - name: Upload snap asset
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@27121b0bdffd731efa15d66772be8dc71245d074  # v2.2.4
         with:
           name: bw_${{ env.PACKAGE_VERSION }}_amd64.snap
           path: ./dist/snap/bw_${{ env.PACKAGE_VERSION }}_amd64.snap
 
       - name: Upload snap checksum asset
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@27121b0bdffd731efa15d66772be8dc71245d074  # v2.2.4
         with:
           name: bw-snap-sha256-${{ env.PACKAGE_VERSION }}.txt
           path: ./dist/snap/bw-snap-sha256-${{ env.PACKAGE_VERSION }}.txt
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 5a0aabe33e..e8503b88a2 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,6 +1,7 @@
+---
 name: Deploy
 
-on: 
+on:
   workflow_dispatch:
     inputs:
       release_tag_name_input:
@@ -13,13 +14,14 @@ on:
 
 jobs:
   setup:
+    name: Setup
     runs-on: ubuntu-latest
     outputs:
       package_version: ${{ steps.create_tags.outputs.package_version }}
       tag_version: ${{ steps.create_tags.outputs.tag_version }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f  # v2.3.4
         with:
           ref: 'rc'
 
@@ -60,34 +62,34 @@ jobs:
     runs-on: ubuntu-latest
     needs: setup
     env:
-      PKG_VERSION: ${{ needs.setup.outputs.package_version }}
-      TAG_VERSION: ${{ needs.setup.outputs.tag_version }}
+      _PKG_VERSION: ${{ needs.setup.outputs.package_version }}
+      _TAG_VERSION: ${{ needs.setup.outputs.tag_version }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f  # v2.3.4
 
       - name: Install Snapcraft
-        uses: samuelmeuli/action-snapcraft@v1
-        with: 
+        uses: samuelmeuli/action-snapcraft@10d7d0a84d9d86098b19f872257df314b0bd8e2d  # v1.2.0
+        with:
           snapcraft_token: ${{ secrets.SNAP_TOKEN }}
 
-      - name: setup
+      - name: Setup
         run: mkdir dist
 
       - name: Get snap release assets
-        uses: Xotl/cool-github-releases@v1
+        uses: Xotl/cool-github-releases@16c58a5863d6ba9944f63ca8bb78bb3249ce1d81  # v1.1.6
         with:
           mode: download
-          tag_name: ${{ env.TAG_VERSION }}
-          assets: bw_${{ env.PKG_VERSION }}_amd64.snap|./dist/bw_${{ env.PKG_VERSION }}_amd64.snap
+          tag_name: ${{ env._TAG_VERSION }}
+          assets: bw_${{ env._PKG_VERSION }}_amd64.snap|./dist/bw_${{ env._PKG_VERSION }}_amd64.snap
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: test
+      - name: Test
         run: ls -alht dist
 
       - name: Publish Snap & logout
         run: |
-          snapcraft push ./dist/bw_${{ env.PKG_VERSION }}_amd64.snap --release stable
+          snapcraft push ./dist/bw_${{ env._PKG_VERSION }}_amd64.snap --release stable
           snapcraft logout
 
 
@@ -96,11 +98,11 @@ jobs:
     runs-on: windows-latest
     needs: setup
     env:
-      PKG_VERSION: ${{ needs.setup.outputs.package_version }}
-      TAG_VERSION: ${{ needs.setup.outputs.tag_version }}
+      _PKG_VERSION: ${{ needs.setup.outputs.package_version }}
+      _TAG_VERSION: ${{ needs.setup.outputs.tag_version }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f  # v2.3.4
         with:
           ref: 'rc'
 
@@ -109,16 +111,16 @@ jobs:
         env:
           CHOCO_API_KEY: ${{ secrets.CHOCO_API_KEY }}
 
-      - name: make dist dir 
+      - name: Make dist dir
         shell: pwsh
         run: New-Item -ItemType directory -Path ./dist
 
       - name: Get nupkg release asset
-        uses: Xotl/cool-github-releases@v1
+        uses: Xotl/cool-github-releases@16c58a5863d6ba9944f63ca8bb78bb3249ce1d81  # v1.1.6
         with:
           mode: download
-          tag_name: ${{ env.TAG_VERSION }}
-          assets: bitwarden-cli.${{ env.PKG_VERSION }}.nupkg|./dist/bitwarden-cli.${{ env.PKG_VERSION }}.nupkg
+          tag_name: ${{ env._TAG_VERSION }}
+          assets: bitwarden-cli.${{ env._PKG_VERSION }}.nupkg|./dist/bitwarden-cli.${{ env._PKG_VERSION }}.nupkg
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Push to Chocolatey
@@ -133,7 +135,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f  # v2.3.4
         with:
           ref: 'rc'
 
@@ -143,11 +145,11 @@ jobs:
           "//registry.npmjs.org/:_authToken=${env:NPM_TOKEN}" | Out-File ".npmrc" -Encoding UTF8
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          
+
       - name: Setup sub-module
         run: npm run sub:init
 
-      - name: npm install
+      - name: NPM install
         run: npm install
 
       - name: Publish NPM
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9ac57c1b1f..d9bbf61f2a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,3 +1,4 @@
+---
 name: Release
 
 on:
@@ -10,6 +11,7 @@ on:
 
 jobs:
   setup:
+    name: Setup
     runs-on: ubuntu-latest
     outputs:
       release_upload_url: ${{ steps.create_release.outputs.upload_url }}
@@ -68,8 +70,8 @@ jobs:
     runs-on: windows-latest
     needs: setup
     env:
-      WIN_PKG_FETCH_VERSION: 14.17.0
-      WIN_PKG_VERSION: 3.1
+      _WIN_PKG_FETCH_VERSION: 14.17.0
+      _WIN_PKG_VERSION: 3.1
     steps:
       - name: Checkout repo
         uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f  # 2.3.4
@@ -98,11 +100,11 @@ jobs:
         shell: pwsh
         run: |
           cd $HOME
-          $fetchedUrl = "https://github.com/vercel/pkg-fetch/releases/download/v$env:WIN_PKG_VERSION/node-v$env:WIN_PKG_FETCH_VERSION-win-x64"
+          $fetchedUrl = "https://github.com/vercel/pkg-fetch/releases/download/v$env:_WIN_PKG_VERSION/node-v$env:_WIN_PKG_FETCH_VERSION-win-x64"
 
           New-Item -ItemType directory -Path .\.pkg-cache
-          New-Item -ItemType directory -Path .\.pkg-cache\v$env:WIN_PKG_VERSION
-          Invoke-RestMethod -Uri $fetchedUrl -OutFile ".\.pkg-cache\v$env:WIN_PKG_VERSION\fetched-v$env:WIN_PKG_FETCH_VERSION-win-x64"
+          New-Item -ItemType directory -Path .\.pkg-cache\v$env:_WIN_PKG_VERSION
+          Invoke-RestMethod -Uri $fetchedUrl -OutFile ".\.pkg-cache\v$env:_WIN_PKG_VERSION\fetched-v$env:_WIN_PKG_FETCH_VERSION-win-x64"
 
       - name: Setup Version Info
         shell: pwsh
@@ -113,8 +115,8 @@ jobs:
         shell: cmd
         run: |
           set PATH=%PATH%;C:\Program Files (x86)\Resource Hacker
-          set WIN_PKG=C:\Users\runneradmin\.pkg-cache\v%WIN_PKG_VERSION%\fetched-v%WIN_PKG_FETCH_VERSION%-win-x64
-          set WIN_PKG_BUILT=C:\Users\runneradmin\.pkg-cache\v%WIN_PKG_VERSION%\built-v%WIN_PKG_FETCH_VERSION%-win-x64
+          set WIN_PKG=C:\Users\runneradmin\.pkg-cache\v%_WIN_PKG_VERSION%\fetched-v%_WIN_PKG_FETCH_VERSION%-win-x64
+          set WIN_PKG_BUILT=C:\Users\runneradmin\.pkg-cache\v%_WIN_PKG_VERSION%\built-v%_WIN_PKG_FETCH_VERSION%-win-x64
 
           copy %WIN_PKG% %WIN_PKG_BUILT%
           ResourceHacker -open %WIN_PKG_BUILT% -save %WIN_PKG_BUILT% -action delete -mask ICONGROUP,1,
@@ -123,7 +125,7 @@ jobs:
 
       - name: Setup sub-module
         run: npm run sub:init
-      
+
       - name: Install
         run: npm install
 
@@ -254,11 +256,11 @@ jobs:
   snap:
     name: Release Snap
     runs-on: ubuntu-latest
-    needs: 
+    needs:
       - setup
       - cli
     env:
-      PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }}
+      _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }}
     steps:
       - name: Checkout repo
         uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f  # 2.3.4
@@ -268,7 +270,7 @@ jobs:
           whoami
           echo "GitHub ref: $GITHUB_REF"
           echo "GitHub event: $GITHUB_EVENT"
-          echo "BW Package Version: $PACKAGE_VERSION"
+          echo "BW Package Version: $_PACKAGE_VERSION"
         env:
           GITHUB_REF: ${{ github.ref }}
           GITHUB_EVENT: ${{ github.event_name }}
@@ -276,14 +278,14 @@ jobs:
       - name: Get linux zip artifact
         uses: actions/download-artifact@158ca71f7c614ae705e79f25522ef4658df18253  # 2.0.9
         with:
-          name: bw-linux-${{ env.PACKAGE_VERSION }}.zip
+          name: bw-linux-${{ env._PACKAGE_VERSION }}.zip
           path: ./dist/snap
 
       - name: Setup Snap Package
         run: |
           cp -r stores/snap/* -t dist/snap
-          sed -i s/__version__/${{ env.PACKAGE_VERSION }}/g dist/snap/snapcraft.yaml
-          
+          sed -i s/__version__/${{ env._PACKAGE_VERSION }}/g dist/snap/snapcraft.yaml
+
           cd dist/snap
           ls -alth
 
@@ -296,16 +298,16 @@ jobs:
         run: |
           cd dist/snap
           ls -alth
-          sha256sum bw_${{ env.PACKAGE_VERSION }}_amd64.snap | awk '{split($0, a); print a[1]}' > bw-snap-sha256-${{ env.PACKAGE_VERSION }}.txt
+          sha256sum bw_${{ env._PACKAGE_VERSION }}_amd64.snap | awk '{split($0, a); print a[1]}' > bw-snap-sha256-${{ env._PACKAGE_VERSION }}.txt
 
-      - name: Install Snap 
+      - name: Install Snap
         run: sudo snap install ./dist/snap/bw*.snap --dangerous
 
       - name: Test Snap
         shell: pwsh
         run: |
           $testVersion = Invoke-Expression '& bw -v'
-          if($testVersion -ne $env:PACKAGE_VERSION) {
+          if($testVersion -ne $env:_PACKAGE_VERSION) {
             Throw "Version test failed."
           }
         env:
@@ -322,8 +324,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           upload_url: ${{ needs.setup.outputs.release_upload_url }}
-          asset_name: bw_${{ env.PACKAGE_VERSION }}_amd64.snap
-          asset_path: ./dist/snap/bw_${{ env.PACKAGE_VERSION }}_amd64.snap
+          asset_name: bw_${{ env._PACKAGE_VERSION }}_amd64.snap
+          asset_path: ./dist/snap/bw_${{ env._PACKAGE_VERSION }}_amd64.snap
           asset_content_type: application
 
       - name: Upload snap checksum release asset
@@ -332,6 +334,6 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           upload_url: ${{ needs.setup.outputs.release_upload_url }}
-          asset_name: bw-snap-sha256-${{ env.PACKAGE_VERSION }}.txt
-          asset_path: ./dist/snap/bw-snap-sha256-${{ env.PACKAGE_VERSION }}.txt
+          asset_name: bw-snap-sha256-${{ env._PACKAGE_VERSION }}.txt
+          asset_path: ./dist/snap/bw-snap-sha256-${{ env._PACKAGE_VERSION }}.txt
           asset_content_type: plain/text