diff --git a/.github/workflows/code-butler.yaml b/.github/workflows/code-butler.yaml
deleted file mode 100644
index 8e95270eb1..0000000000
--- a/.github/workflows/code-butler.yaml
+++ /dev/null
@@ -1,32 +0,0 @@
-name: code_butler
-
-permissions:
-  contents: read
-  pull-requests: write
-
-on:
-  issue_comment:
-    types: [created]
-
-jobs:
-  review:
-    if: startsWith(github.event.comment.body, '/review')
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: ca-dp/code-butler@v1
-        with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-          cmd: review
-          model: gpt-4-1106-preview
-  chat:
-    if: startsWith(github.event.comment.body, '/chat')
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: ca-dp/code-butler@v1
-        with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-          cmd: chat
-          model: gpt-4-1106-preview
-          comment_body: ${{ github.event.comment.body }}
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index 321a598289..b79d88ffec 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -21,5 +21,4 @@ jobs:
           close-pr-message: 'This PR was closed because it has been stalled for 7 days with no activity. Feel free to reopen if still applicable.'
           days-before-pr-stale: 30
           days-before-pr-close: 7
-          delete-branch: true
-          exempt-pr-labels: 'not-auto-close'
\ No newline at end of file
+          exempt-pr-labels: 'not-auto-close'
diff --git a/.github/workflows/thank-you.yaml b/.github/workflows/thank-you.yaml
index 782c4a68f4..314b9ea6fe 100644
--- a/.github/workflows/thank-you.yaml
+++ b/.github/workflows/thank-you.yaml
@@ -11,13 +11,13 @@ permissions:
 
 jobs:
   thank-you:
-    # Only run if the PR was actually merged
-    if: github.event.pull_request.merged
+    if: github.event.pull_request.merged == true
     runs-on: ubuntu-latest
     steps:
-      # We must check out the code to read the MAINTAINERS.json file
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
 
       - name: Leave a Thank You Comment
         uses: actions/github-script@v7
@@ -26,29 +26,24 @@ jobs:
             const fs = require('fs');
             const creator = context.payload.pull_request.user.login;
             
-            // Skip bots to avoid comment loops
             if (creator.endsWith('[bot]')) {
               console.log('Skipping bot account.');
               return;
             }
 
-            // Read maintainers list from JSON file
             const maintainersData = JSON.parse(fs.readFileSync('MAINTAINERS.json', 'utf8'));
             const maintainers = maintainersData.maintainers.map(m => m.toLowerCase());
             
-            // Skip core maintainers to avoid spamming the team
             if (maintainers.includes(creator.toLowerCase())) {
               console.log(`Skipping maintainer account: ${creator}`);
               return;
             }
 
-            const message = 'Thank you for contributing to PipeCD! The changes in this pull request will be part of the upcoming release!';
+            const message = `Thank you for contributing to PipeCD, @${creator}! The changes in this pull request will be part of the upcoming release!`;
 
-            // Post the comment to the PR
             await github.rest.issues.createComment({
               owner: context.repo.owner,
               repo: context.repo.repo,
               issue_number: context.payload.pull_request.number,
               body: message
             });
-            
\ No newline at end of file
diff --git a/docs/README.md b/docs/README.md
index 7624567e64..cc951bcb29 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,4 +1,4 @@
-# Documentation
+# Documentation XYZ CHANGE FOR TESTING
 
 The source files for the documentation is placing in [content](https://github.com/pipe-cd/pipecd/tree/master/docs/content) directory.
 
diff --git a/workflow-audit/issues/security-code-butler-unpinned-abandoned.md b/workflow-audit/issues/security-code-butler-unpinned-abandoned.md
new file mode 100644
index 0000000000..b5d722e4bf
--- /dev/null
+++ b/workflow-audit/issues/security-code-butler-unpinned-abandoned.md
@@ -0,0 +1,21 @@
+# Security: code-butler.yaml uses unpinned third-party action with API key access
+
+**File:** `.github/workflows/code-butler.yaml`
+
+## Problem
+
+`ca-dp/code-butler@v1` is:
+- **Not SHA-pinned**: the `v1` mutable tag means any push to the upstream repo moves what this action executes. Anyone who compromises that repo gets code execution in PipeCD CI with access to `OPENAI_API_KEY`.
+- **Uses a deprecated model**: `gpt-4-1106-preview` was deprecated by OpenAI in early 2024. The action may already be broken.
+- **Third-party, low-visibility**: `ca-dp` is not a well-known GitHub Actions publisher. The action has minimal community scrutiny.
+
+## Impact
+
+- `OPENAI_API_KEY` secret is passed to an unpinned, third-party action.
+- `/review` and `/chat` commands on PRs may already be non-functional.
+
+## Recommended Fix
+
+Option A (preferred): Remove the workflow and revoke/rotate `OPENAI_API_KEY`. Check git history for last successful use — if it has not worked since the model was deprecated, it is already dead.
+
+Option B: If AI review is actively used, replace with a custom `actions/github-script` step that calls the API directly (code lives in-repo, no third-party action trust required), and use a current model.