diff --git a/application-restricted-signed-jwt-tutorials/php/auth/JwtHandler.php b/application-restricted-signed-jwt-tutorials/php/auth/JwtHandler.php
index 50a112e..b321672 100644
--- a/application-restricted-signed-jwt-tutorials/php/auth/JwtHandler.php
+++ b/application-restricted-signed-jwt-tutorials/php/auth/JwtHandler.php
@@ -44,7 +44,7 @@ public function GenerateJwt()
     return $jwt;
   }
 
-  function base64UrlEncode($data)
+  private function base64UrlEncode($data)
   {
     return \str_replace('=', '', \strtr(\base64_encode($data), '+/', '-_'));
   }
diff --git a/scripts/githooks/scan-secrets.sh b/scripts/githooks/scan-secrets.sh
index be4b791..45c4c8b 100644
--- a/scripts/githooks/scan-secrets.sh
+++ b/scripts/githooks/scan-secrets.sh
@@ -42,7 +42,7 @@ function main() {
 function get-cmd-to-run() {
 
   check=${check:-staged-changes}
-  case $check in
+  case "$check" in
     "whole-history")
       cmd="detect --source $dir --verbose --redact"
       ;;
@@ -52,9 +52,13 @@ function get-cmd-to-run() {
     "staged-changes")
       cmd="protect --source $dir --verbose --staged"
       ;;
+    *)
+      echo "ERROR: Invalid check value: '$check'" >&2
+      exit 1
+      ;;
   esac
   # Include base line file if it exists
-  if [ -f "$dir/scripts/config/.gitleaks-baseline.json" ]; then
+  if [[ -f "$dir/scripts/config/.gitleaks-baseline.json" ]]; then
     cmd="$cmd --baseline-path $dir/scripts/config/.gitleaks-baseline.json"
   fi
   # Include the config file
@@ -94,8 +98,8 @@ function run-gitleaks-in-docker() {
 # ==============================================================================
 
 function is-arg-true() {
-
-  if [[ "$1" =~ ^(true|yes|y|on|1|TRUE|YES|Y|ON)$ ]]; then
+  local value="$1"
+  if [[ "$value" =~ ^(true|yes|y|on|1|TRUE|YES|Y|ON)$ ]]; then
     return 0
   else
     return 1
diff --git a/user-restricted-combined-auth-tutorials/cis2/php/config/preload.php b/user-restricted-combined-auth-tutorials/cis2/php/config/preload.php
index 5ebcdb2..579e4c4 100644
--- a/user-restricted-combined-auth-tutorials/cis2/php/config/preload.php
+++ b/user-restricted-combined-auth-tutorials/cis2/php/config/preload.php
@@ -1,5 +1,5 @@
 <?php
 
 if (file_exists(dirname(__DIR__).'/var/cache/prod/App_KernelProdContainer.preload.php')) {
-    require dirname(__DIR__).'/var/cache/prod/App_KernelProdContainer.preload.php';
+    require_once dirname(__DIR__).'/var/cache/prod/App_KernelProdContainer.preload.php';
 }
diff --git a/user-restricted-combined-auth-tutorials/cis2/php/tests/bootstrap.php b/user-restricted-combined-auth-tutorials/cis2/php/tests/bootstrap.php
index 469dcce..cfa16de 100644
--- a/user-restricted-combined-auth-tutorials/cis2/php/tests/bootstrap.php
+++ b/user-restricted-combined-auth-tutorials/cis2/php/tests/bootstrap.php
@@ -2,10 +2,10 @@
 
 use Symfony\Component\Dotenv\Dotenv;
 
-require dirname(__DIR__).'/vendor/autoload.php';
+require_once dirname(__DIR__).'/vendor/autoload.php';
 
 if (file_exists(dirname(__DIR__).'/config/bootstrap.php')) {
-    require dirname(__DIR__).'/config/bootstrap.php';
+    require_once dirname(__DIR__).'/config/bootstrap.php';
 } elseif (method_exists(Dotenv::class, 'bootEnv')) {
     (new Dotenv())->bootEnv(dirname(__DIR__).'/.env');
 }
diff --git a/user-restricted-combined-auth-tutorials/nhs-login/php/config/preload.php b/user-restricted-combined-auth-tutorials/nhs-login/php/config/preload.php
index 5ebcdb2..579e4c4 100644
--- a/user-restricted-combined-auth-tutorials/nhs-login/php/config/preload.php
+++ b/user-restricted-combined-auth-tutorials/nhs-login/php/config/preload.php
@@ -1,5 +1,5 @@
 <?php
 
 if (file_exists(dirname(__DIR__).'/var/cache/prod/App_KernelProdContainer.preload.php')) {
-    require dirname(__DIR__).'/var/cache/prod/App_KernelProdContainer.preload.php';
+    require_once dirname(__DIR__).'/var/cache/prod/App_KernelProdContainer.preload.php';
 }
diff --git a/user-restricted-combined-auth-tutorials/nhs-login/php/tests/bootstrap.php b/user-restricted-combined-auth-tutorials/nhs-login/php/tests/bootstrap.php
index 469dcce..cfa16de 100644
--- a/user-restricted-combined-auth-tutorials/nhs-login/php/tests/bootstrap.php
+++ b/user-restricted-combined-auth-tutorials/nhs-login/php/tests/bootstrap.php
@@ -2,10 +2,10 @@
 
 use Symfony\Component\Dotenv\Dotenv;
 
-require dirname(__DIR__).'/vendor/autoload.php';
+require_once dirname(__DIR__).'/vendor/autoload.php';
 
 if (file_exists(dirname(__DIR__).'/config/bootstrap.php')) {
-    require dirname(__DIR__).'/config/bootstrap.php';
+    require_once dirname(__DIR__).'/config/bootstrap.php';
 } elseif (method_exists(Dotenv::class, 'bootEnv')) {
     (new Dotenv())->bootEnv(dirname(__DIR__).'/.env');
 }
diff --git a/user-restricted-separate-auth-tutorials/cis2/php/config/preload.php b/user-restricted-separate-auth-tutorials/cis2/php/config/preload.php
index 5ebcdb2..579e4c4 100644
--- a/user-restricted-separate-auth-tutorials/cis2/php/config/preload.php
+++ b/user-restricted-separate-auth-tutorials/cis2/php/config/preload.php
@@ -1,5 +1,5 @@
 <?php
 
 if (file_exists(dirname(__DIR__).'/var/cache/prod/App_KernelProdContainer.preload.php')) {
-    require dirname(__DIR__).'/var/cache/prod/App_KernelProdContainer.preload.php';
+    require_once dirname(__DIR__).'/var/cache/prod/App_KernelProdContainer.preload.php';
 }
diff --git a/user-restricted-separate-auth-tutorials/cis2/php/src/Service/ISTokenExchange.php b/user-restricted-separate-auth-tutorials/cis2/php/src/Service/ISTokenExchange.php
index 2b9d858..496d4f9 100644
--- a/user-restricted-separate-auth-tutorials/cis2/php/src/Service/ISTokenExchange.php
+++ b/user-restricted-separate-auth-tutorials/cis2/php/src/Service/ISTokenExchange.php
@@ -7,7 +7,7 @@ class ISTokenExchange {
     private $subject_token;
     private $client_assertion;
     
-  function __construct($subject_token, $client_assertion)
+  public function __construct($subject_token, $client_assertion)
   {
     $this->subject_token = $subject_token;
     $this->client_assertion = $client_assertion;
diff --git a/user-restricted-separate-auth-tutorials/cis2/php/src/Service/JwtHandler.php b/user-restricted-separate-auth-tutorials/cis2/php/src/Service/JwtHandler.php
index 93caf7c..5b7a0ab 100644
--- a/user-restricted-separate-auth-tutorials/cis2/php/src/Service/JwtHandler.php
+++ b/user-restricted-separate-auth-tutorials/cis2/php/src/Service/JwtHandler.php
@@ -10,7 +10,7 @@ class JwtHandler
   private $privateKeyFile;
   private $alg;
 
-  function __construct($privateKeyFile, $audience, $client_id, $kid, $alg, $alg_encrypt)
+  public function __construct($privateKeyFile, $audience, $client_id, $kid, $alg, $alg_encrypt)
   {
     $this->audience = $audience;
     $this->client_id = $client_id;
@@ -47,7 +47,7 @@ public function GenerateJwt()
     return $jwt;
   }
 
-  function base64UrlEncode($data)
+  private function base64UrlEncode($data)
   {
     return \str_replace('=', '', \strtr(\base64_encode($data), '+/', '-_'));
   }
diff --git a/user-restricted-separate-auth-tutorials/cis2/php/src/Service/SeparateAuthHttpClient.php b/user-restricted-separate-auth-tutorials/cis2/php/src/Service/SeparateAuthHttpClient.php
index 78eef57..bbebed1 100644
--- a/user-restricted-separate-auth-tutorials/cis2/php/src/Service/SeparateAuthHttpClient.php
+++ b/user-restricted-separate-auth-tutorials/cis2/php/src/Service/SeparateAuthHttpClient.php
@@ -8,7 +8,7 @@ class SeparateAuthHttpClient {
     private $jwt;
     private $tokenUrl;
 
-  function __construct($code, $jwt, $tokenUrl)
+  public function __construct($code, $jwt, $tokenUrl)
   {
     $this->code = $code;
     $this->jwt = $jwt;
diff --git a/user-restricted-separate-auth-tutorials/nhs-login/php/config/preload.php b/user-restricted-separate-auth-tutorials/nhs-login/php/config/preload.php
index 5ebcdb2..579e4c4 100644
--- a/user-restricted-separate-auth-tutorials/nhs-login/php/config/preload.php
+++ b/user-restricted-separate-auth-tutorials/nhs-login/php/config/preload.php
@@ -1,5 +1,5 @@
 <?php
 
 if (file_exists(dirname(__DIR__).'/var/cache/prod/App_KernelProdContainer.preload.php')) {
-    require dirname(__DIR__).'/var/cache/prod/App_KernelProdContainer.preload.php';
+    require_once dirname(__DIR__).'/var/cache/prod/App_KernelProdContainer.preload.php';
 }
diff --git a/user-restricted-separate-auth-tutorials/nhs-login/php/src/Service/ISTokenExchange.php b/user-restricted-separate-auth-tutorials/nhs-login/php/src/Service/ISTokenExchange.php
index f1aec6b..8e47c5c 100644
--- a/user-restricted-separate-auth-tutorials/nhs-login/php/src/Service/ISTokenExchange.php
+++ b/user-restricted-separate-auth-tutorials/nhs-login/php/src/Service/ISTokenExchange.php
@@ -7,7 +7,7 @@ class ISTokenExchange {
     private $subject_token;
     private $client_assertion;
     
-  function __construct($subject_token, $client_assertion)
+  public function __construct($subject_token, $client_assertion)
   {
     $this->subject_token = $subject_token;
     $this->client_assertion = $client_assertion;
diff --git a/user-restricted-separate-auth-tutorials/nhs-login/php/src/Service/JwtHandler.php b/user-restricted-separate-auth-tutorials/nhs-login/php/src/Service/JwtHandler.php
index 6d49005..3e8b7d8 100644
--- a/user-restricted-separate-auth-tutorials/nhs-login/php/src/Service/JwtHandler.php
+++ b/user-restricted-separate-auth-tutorials/nhs-login/php/src/Service/JwtHandler.php
@@ -49,7 +49,7 @@ public function GenerateJwt()
     return $jwt;
   }
 
-  function base64UrlEncode($data)
+  private function base64UrlEncode($data)
   {
     return \str_replace('=', '', \strtr(\base64_encode($data), '+/', '-_'));
   }
diff --git a/user-restricted-separate-auth-tutorials/nhs-login/php/src/Service/SeparateAuthHttpClient.php b/user-restricted-separate-auth-tutorials/nhs-login/php/src/Service/SeparateAuthHttpClient.php
index 597d60d..a17d8c6 100644
--- a/user-restricted-separate-auth-tutorials/nhs-login/php/src/Service/SeparateAuthHttpClient.php
+++ b/user-restricted-separate-auth-tutorials/nhs-login/php/src/Service/SeparateAuthHttpClient.php
@@ -8,7 +8,7 @@ class SeparateAuthHttpClient {
     private $jwt;
     private $tokenUrl;
 
-  function __construct($code, $jwt, $tokenUrl)
+  public function __construct($code, $jwt, $tokenUrl)
   {
     $this->code = $code;
     $this->jwt = $jwt;
diff --git a/user-restricted-separate-auth-tutorials/nhs-login/php/tests/bootstrap.php b/user-restricted-separate-auth-tutorials/nhs-login/php/tests/bootstrap.php
index 469dcce..cfa16de 100644
--- a/user-restricted-separate-auth-tutorials/nhs-login/php/tests/bootstrap.php
+++ b/user-restricted-separate-auth-tutorials/nhs-login/php/tests/bootstrap.php
@@ -2,10 +2,10 @@
 
 use Symfony\Component\Dotenv\Dotenv;
 
-require dirname(__DIR__).'/vendor/autoload.php';
+require_once dirname(__DIR__).'/vendor/autoload.php';
 
 if (file_exists(dirname(__DIR__).'/config/bootstrap.php')) {
-    require dirname(__DIR__).'/config/bootstrap.php';
+    require_once dirname(__DIR__).'/config/bootstrap.php';
 } elseif (method_exists(Dotenv::class, 'bootEnv')) {
     (new Dotenv())->bootEnv(dirname(__DIR__).'/.env');
 }