Skip to content

Security: yashyaadav/cloud-engineering-toolkit

Security

SECURITY.md

Security

Reporting a vulnerability

If you believe you've found a security issue in any script in this repo, please email yashyadav34@gmail.com with the details. Do not open a public issue.

What this repo is, and what it isn't

These scripts are illustrative examples of cloud operations work — they reflect how I've solved real problems, but they are not maintained as a production library. Before running anything from here against your own infrastructure:

  1. Read the script. Most scripts perform irreversible operations (delete unused volumes, deactivate access keys, terminate idle instances).
  2. Run it in a sandbox first, or with the most restrictive IAM/role you can use.
  3. Check for dry-run flags. Many scripts default to read-only; a few do not.
  4. Configure credentials via environment variables, not in code. See docs/credentials.md.

Things this repo will never contain

  • Hardcoded credentials, API tokens, private keys, or PEM/PPK files.
  • Real account IDs, tenant/subscription IDs, or customer-identifying info.
  • Anything covered by a non-disclosure agreement.

If you spot something in this repo that looks like one of the above, please email me immediately so I can rotate and remove it.

There aren't any published security advisories