Google Ads Guard CLI is read-only in version 0.1.x. It must never call a Google Ads mutate endpoint.

• Never pass developer tokens, access tokens, refresh tokens, OAuth client secrets, or service-account keys as command arguments.
• Profiles contain environment-variable names and expected identities only, never secret values.
• The gcloud provider invokes a fixed executable and fixed argument list without a shell. It relies on the credential storage and account selection managed by Google Cloud CLI.
• Diagnostic errors are redacted before they are written. Evidence reports can contain account names, IDs, and returned Google Ads data, so operators must store them appropriately.

Open a GitHub security advisory. Do not include a working credential, customer export, or private account identifier in an issue.

Only the latest 0.1.x release is supported until the first stable release.