Do not open a public issue for a suspected vulnerability or exposed credential. Use GitHub private vulnerability reporting after it is enabled.

• Use short-lived provider credentials with least privilege.
• Keep vars.sh, *.tfvars, certificates, private keys, state, and plans out of Git.
• Store production Terraform state in an encrypted remote backend with locking.
• Review terraform plan output before every apply.
• Restrict SSH and management CIDRs.
• Treat Terraform state as secret.
• Rotate any credential that has ever been committed or improperly shared.

Security fixes are applied to the current main branch until a formal release policy is established.