Report vulnerabilities privately through GitHub Security Advisories on this repository. Please do not disclose details publicly until a fix is released.

• SSH and sudo passwords are passed over stdin or the SSHPASS environment variable, never as command-line arguments.
• Action plans are produced by adapters, which own the safe construction of the shell snippets they emit; values taken from a source plan are shell-quoted. Treat a hand-edited action plan as arbitrary code and review it before running.
• Every action carries a re-validation guard. run executes an action only when its guard confirms the change is still needed on the host.
• Action plans and results describe changes to your fleet. They are gitignored. Do not commit them.