Security
Audion DevOps Tools is intended for local Windows-first DevOps workflows. It may inspect or modify network settings, WSL distributions, hosts files, disk/WinRE state, local paths, logs and generated reports.
Do Not Commit Secrets
Common secret patterns:
.env.env.*api_key*.txt*.key*.pem- exported OpenSSH KeyKit archives
- Certificate KeyKit
.pfxexports - Machine migration folders under
output\migrationand access bundles underoutput\access: they hold private keys, and clear-text Wi-Fi passwords, collected in one place - Wi-Fi profile XML files exported with clear keys
- exported environment dumps
- logs that contain credentials or access tokens
Use environment variables, local ignored files, or your organization's secret manager.
Data Handling
The tool itself does not require external API calls for project business logic. Some actions may call Windows tooling, WSL, package managers or network services selected by the user. Process only systems and data you are authorized to administer.
OpenSSH KeyKit exports, Certificate KeyKit PFX backups and Network Cleaner Wi-Fi-key backups may contain private keys or clear Wi-Fi passwords. Treat those outputs as secrets, store them outside public repositories and delete temporary copies when they are no longer needed.
Administrator Tooling Boundary
System-changing features are designed around documented administrator/deployment mechanisms where possible: DISM, HKLM policy, wsl.exe, netsh wlan, PowerShell PKI cmdlets, bcdedit, WinRE/storage tooling and Windows optional features. The project does not hand-edit protected UserChoice hashes or bypass UCPD, and it ships no third-party helper that does. Association snapshots read UserChoice\ProgId and never write it back.
Virtualization mode changes export a BCD backup before mutation and require a reboot. VBS/Core Isolation/Credential Guard state is reported for diagnosis; optimization status also reports power plan, Defender exclusions, .wslconfig and WSL VHDX placement without changing them. This project does not disable the VBS/Core Isolation security domain.
Default Apps Guard does not promise policy enforcement on Windows Home/Core. Unsupported editions are reported in status and blocked by default for policy apply unless the user enables an explicit expert override.
Portable Runtime Note
The portable runtime removes the requirement for a system Python installation. It does not remove the need to protect local config files, path histories, credentials, logs, and generated reports.
Path History
If a project stores recent source/target paths, treat config\path_history.json as local user state. Do not publish private network paths, customer folders, or machine-specific drive layouts.