This repository contains automation that interacts with Azure DevOps via the REST API. Before publishing this project publicly, follow these rules to avoid accidental secret exposure and to handle reports responsibly.

• Never commit Personal Access Tokens (PATs), service principal secrets, or any credentials.
• Use environment variables (for example AZDO_PAT) or a secret manager to provide secrets at runtime.

1. Revoke or rotate the exposed secret immediately (PAT, service principal, etc.).
2. Remove the secret from the repository history (use git-filter-repo or BFG) and force-push to protected branches only when necessary.
3. Inform your security team and follow your org's incident response process.

If you discover a security issue in this project, create an issue in this repo with the label security or contact the repository owners off-band. Do not post secrets publicly.

• Add a pre-commit hook to scan for secrets (eg. pre-commit, gitleaks) in your CI pipeline.
• Use short-lived PATs or service principals with minimal scopes for automation.
• Consider integrating with Azure Key Vault, GitHub Secrets, or other secret stores for CI/CD.