Please do not open a public issue for security vulnerabilities.

Instead, report privately to the maintainers:

• Email: kartikmanimuthu@gmail.com
• Subject: [terragrunt-101] Security: <short description>

You will get an acknowledgement within 48 hours, and we will aim to resolve confirmed vulnerabilities in the next release. When in doubt, report it — even a low-impact issue helps the ecosystem.

• live/ — Terragrunt unit configuration that deploys AWS resources (VPC, RDS, ECS, account baseline). Misconfigurations here can create real cloud resources in your accounts.
• modules/ — the reusable Terraform modules (unchanged from Act 1).

• Credentials: never commit ~/.aws/credentials or access keys. All auth goes through named profiles declared in live/<account>/account.hcl (or OIDC in CI).
• State: state files can contain sensitive output values. They are stored in S3 with SSE-AES256 + TLS-only access; never commit *.tfstate* (see .gitignore).
• Account guard: every generated provider carries allowed_account_ids — do not remove it. It is the trip-wire that stops a mis-targeted credential from touching the wrong account.
• Prod hardening: live/prod deliberately uses deletion_protection = true, multi-AZ, longer backup retention. Do not weaken these without an explicit reason and a comment.