diff --git a/.cspell.json b/.cspell.json
index 6601992..51ed83f 100644
--- a/.cspell.json
+++ b/.cspell.json
@@ -1,6 +1,11 @@
 {
   "language": "en",
-  "dictionaries": ["companies", "filetypes", "fullstack", "softwareTerms"],
+  "dictionaries": [
+    "companies",
+    "filetypes",
+    "fullstack",
+    "softwareTerms"
+  ],
   "words": [
     "aquasecurity",
     "artipacked",
@@ -40,22 +45,23 @@
     "zizmor"
   ],
   "flagWords": [
-    "abort",
-    "abortion",
-    "blackhat",
-    "black-hat",
-    "whitehat",
-    "white-hat",
-    "cripple",
-    "crippled",
-    "master",
-    "slave",
-    "tribe",
-    "sanity-check",
-    "whitelist",
-    "white-list",
-    "blacklist",
-    "black-list"
+    "abort: cancel, end, fail, halt, stop, terminate",
+    "abortion: cancelation, ending, failure, halting, stopping, termination",
+    "blackhat: attacker, malicious",
+    "black-hat: attacker, malicious",
+    "whitehat: ethical, security, researcher",
+    "white-hat: ethical, security, researcher",
+    "cripple: disable, degrade, impact",
+    "crippled: disabled, degraded, impacted",
+    "grandfathered: legacy, exempted, preauthorized",
+    "master: controller, primary, main, leader, parent",
+    "slave: agent, replica, secondary, follower, child",
+    "tribe: squad, team, group",
+    "sanity-check: test, verify, validate",
+    "whitelist: allowlist",
+    "white-list: allow-list",
+    "blacklist: denylist",
+    "black-list: deny-list"
   ],
   "ignorePaths": [
     ".cspell.json",
@@ -68,7 +74,9 @@
   "languageSettings": [
     {
       "languageId": "markdown",
-      "ignoreRegExpList": ["/^\\s*```\\s*(mermaid)[\\s\\S]*?^\\s*```/gm"]
+      "ignoreRegExpList": [
+        "/^\\s*```\\s*(mermaid)[\\s\\S]*?^\\s*```/gm"
+      ]
     }
   ]
 }
diff --git a/.github/workflows/mega-linter.yml b/.github/workflows/mega-linter.yml
index 66a695b..b5d036d 100644
--- a/.github/workflows/mega-linter.yml
+++ b/.github/workflows/mega-linter.yml
@@ -37,6 +37,10 @@ jobs:
         # `megalinter` target in the Makefile.
         uses: oxsecurity/megalinter/flavors/go@ef3e84b8b836d76db562d0f3ed7da61e8fd538bc  # v9.6.0
         env:
+          # Only Actions-specific values (secrets, runner behavior) belong
+          # here. Generic MegaLinter/repo config belongs in .mega-linter.yml
+          # so local runs (e.g. mega-linter-runner) get the same behavior.
+          #
           # All available variables are described in documentation
           # https://megalinter.io/latest/configuration/
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.gitignore b/.gitignore
index 9374fa0..0d4f855 100644
--- a/.gitignore
+++ b/.gitignore
@@ -119,4 +119,5 @@ docs/_build/
 site/
 
 # Lint files
-megalinter-reports
+# MegaLinter local-run report output.
+megalinter-reports/
diff --git a/README.md b/README.md
index ccf3eb1..f6ba8cf 100644
--- a/README.md
+++ b/README.md
@@ -51,7 +51,7 @@ lfx auth token
 lfx auth logout
 
 # Make an authenticated call to an LFX platform API endpoint.
-lfx api '/my-grants?v=1&object_type=projects'
+lfx api '/my-grants?v=1&object_type=project'
 lfx api /projects --field name=example   # auto-promotes to POST
 lfx api -X PUT /projects/123 --input - -H "If-Match: <ver>" < input.json  # Content-Type: application/json is added automatically
 ```
diff --git a/internal/commands/api_test.go b/internal/commands/api_test.go
index 4aa4ae0..6e514d8 100644
--- a/internal/commands/api_test.go
+++ b/internal/commands/api_test.go
@@ -71,7 +71,7 @@ func TestAPIJoinURL(t *testing.T) {
 		{name: "trailing slash on base", base: "https://api.example.com/", path: "projects", want: "https://api.example.com/projects"},
 		{name: "leading slash on path", base: "https://api.example.com", path: "/projects", want: "https://api.example.com/projects"},
 		{name: "both slashes", base: "https://api.example.com/", path: "/projects", want: "https://api.example.com/projects"},
-		{name: "query string preserved", base: "https://api.example.com", path: "/my-grants?v=1&object_type=projects", want: "https://api.example.com/my-grants?v=1&object_type=projects"},
+		{name: "query string preserved", base: "https://api.example.com", path: "/my-grants?v=1&object_type=project", want: "https://api.example.com/my-grants?v=1&object_type=project"},
 		{name: "fragment preserved", base: "https://api.example.com", path: "/projects#frag", want: "https://api.example.com/projects#frag"},
 		{name: "encoded slash preserved verbatim", base: "https://api.example.com", path: "/objects/a%2Fb", want: "https://api.example.com/objects/a%2Fb"},
 	}