diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a5da2308d0..0be30796ad 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,6 +6,9 @@ on:
     branches:
       - "master"
 
+permissions:
+  contents: read
+
 jobs:
   test-build:
     name: Test Docs Build
diff --git a/.github/workflows/update-version-support.yml b/.github/workflows/update-version-support.yml
index 21e493444a..2493478e2f 100644
--- a/.github/workflows/update-version-support.yml
+++ b/.github/workflows/update-version-support.yml
@@ -8,6 +8,10 @@ on:
 
 run-name: Nightly version support update
 
+permissions:
+  contents: read
+  pull-requests: write
+
 env:
   VERSION_INFO_URL: https://static.metabase.com/version-info.json
   DATA_FILE: _data/major_version_support.json
diff --git a/public/docs/js/anonymous-snowplow.js b/public/docs/js/anonymous-snowplow.js
index ea45887106..069245727e 100644
--- a/public/docs/js/anonymous-snowplow.js
+++ b/public/docs/js/anonymous-snowplow.js
@@ -39,10 +39,18 @@ if (formattedCustomUrlAnon) {
 }
 
 // custom referrer (only for metabase.com)
+var referrerUrlAnon = null;
+try {
+  referrerUrlAnon = document.referrer ? new URL(document.referrer) : null;
+} catch (e) {
+  // Ignore invalid referrer URLs
+}
+
 if (
-  document.referrer &&
-  (document.referrer.indexOf("https://www.metabase.com") > -1 ||
-    document.referrer.indexOf("https://metabase.com") > -1)
+  referrerUrlAnon &&
+  referrerUrlAnon.protocol === "https:" &&
+  (referrerUrlAnon.hostname === "www.metabase.com" ||
+    referrerUrlAnon.hostname === "metabase.com")
 ) {
   var formattedReferrerUrlAnon = window.redirectTo(document.referrer);
   if (formattedReferrerUrlAnon) {
diff --git a/public/docs/js/marketing-snowplow.js b/public/docs/js/marketing-snowplow.js
index 80b85f9937..c700f0c42e 100644
--- a/public/docs/js/marketing-snowplow.js
+++ b/public/docs/js/marketing-snowplow.js
@@ -42,10 +42,18 @@ if (formattedCustomUrl) {
 }
 
 // custom referrer (only for metabase.com)
+var referrerUrl = null;
+try {
+  referrerUrl = document.referrer ? new URL(document.referrer) : null;
+} catch (e) {
+  // Ignore invalid referrer URLs
+}
+
 if (
-  document.referrer &&
-  (document.referrer.indexOf("https://www.metabase.com") > -1 ||
-    document.referrer.indexOf("https://metabase.com") > -1)
+  referrerUrl &&
+  referrerUrl.protocol === "https:" &&
+  (referrerUrl.hostname === "www.metabase.com" ||
+    referrerUrl.hostname === "metabase.com")
 ) {
   var formattedReferrerUrl = window.redirectTo(document.referrer);
   if (formattedReferrerUrl) {