This is a reference architecture built from placeholder values — a demonstration repository, not a deployed service. It contains no real credentials, account identifiers, or infrastructure. Still, if you find a security-relevant defect — an insecure default, a module that provisions something unsafe, a policy gap — please report it.

Open a private security advisory rather than a public issue, or email bezilla@protonmail.com. Include the affected module or workflow and the impact. No response time is promised.

• No long-lived cloud credentials: CI authenticates with GitHub OIDC; workloads use IRSA.
• Secrets are never committed: gitleaks and trufflehog run on every change; database credentials are managed by AWS Secrets Manager; third-party keys come from the environment.
• Security scanning (trivy) and policy-as-code (conftest) gate every change.