This repository is a public reference implementation. It intentionally uses placeholders and example values only.

What you should never commit/publish here:

• Real subscriptionId, tenantId, objectId, clientId values
• Customer / employer names, internal project codenames, or ticket links
• Network fingerprints: real VNet/subnet names, real address spaces, DNS domains
• Any credentials, certificates, keys, or tokens (including .pfx, .pem)
• Deployment logs that can reveal environment identifiers

If you spot something that looks like a secret or an environment fingerprint:

1. Do not open an issue with sensitive data.
2. Instead, open a minimal issue describing the file/path and the type of exposure.
3. Remove/rotate the data in your own environments immediately if you copied it.

• Review Packer provisioning scripts before execution.
• Use trusted sources for any installers (e.g., official Microsoft/GitHub releases).
• Prefer running builds in a controlled CI agent or a dedicated build VM.