This repository contains Ansible playbooks, roles, inventories, plugins, and documentation. The most important security properties are:

1. No secrets in the repo. No real vault passwords, private keys, clouds.yaml credentials, API tokens, or production inventories. The .gitignore blocks vault-password files; all example secrets are clearly fake. Use ansible-vault for anything sensitive.
2. Playbooks are safe to read and adapt. They are idempotent, prefer state: present over latest, set explicit file modes, and support --check where practical. Destructive steps are clearly documented.
3. Least privilege. become is used only where required, never blanket.

If you find committed secrets, a playbook that creates an insecure-by-default posture without warning, or a destructive task without safeguards, report it privately:

• Email: admin@devopsaitoolkit.com
• Or GitHub → Security → Report a vulnerability (private advisory).

Please do not open a public issue for sensitive reports. We aim to acknowledge within 3 business days.

The main branch is supported. Playbooks target ansible-core >= 2.15 and use Fully Qualified Collection Names (FQCNs).