Do not open a public GitHub issue for a security vulnerability.

Email the maintainer with:

• A description of the issue and its impact.
• Steps to reproduce.
• A suggested fix (if you have one).

You should receive an acknowledgement within 3 business days. A typical triage + fix + release cycle is 7–14 days depending on severity.

Security-relevant issues include:

• Secret leakage into logs, transcripts, or error messages.
• Command injection in any parameter that accepts user input.
• Privilege-escalation paths via service-principal or managed-identity auth.
• Bypasses of the preflight policy engine (e.g. a rule that should block prod provisioning in an unapproved region, but silently doesn't).
• Missing or weak validation that allows one tenant's run to affect another.
• Supply-chain issues in dependencies (Microsoft.PowerApps.Administration.PowerShell, Microsoft.PowerShell.SecretManagement).

• Issues in upstream dependencies that aren't reachable through this tool.
• Denial-of-service via huge complexity XML or config files (the tool is interactive and small; these are low-impact).
• Issues that require admin access on the host machine that the wizard is already running with.

• Every secret input parameter (-ClientSecret, anything resolved from Key Vault) is SecureString.
• Protect-EpSecret wraps a SecureString so "$wrapper" returns [REDACTED]. Only an explicit .Reveal() call produces the plaintext.
• EpWizard.Logging applies a default set of redaction regexes to every message; extend with Register-EpLogRedactionPattern.
• Invoke-EpTranscriptScrub does a post-run pass over the transcript when -ScrubTranscript is present.

If you find a secret that survives all three of those, treat it as a P0 bug and follow the reporting process above.