Security

SECURITY.md

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability, please report it responsibly:

Do NOT open a public issue
Email: security@example.com
Include steps to reproduce

Security Best Practices

Never commit credentials, tokens, or account IDs
Use terraform.tfvars (gitignored) for sensitive values
Rotate Service Account keys if accidentally exposed
Enable org policy iam.disableServiceAccountKeyCreation

There aren't any published security advisories