OPSEC Discipline

Overview

Decide the detection footprint and cleanup before acting, not after. Every offensive technique in this repo pairs with the telemetry it generates and a detection signature — use that pairing to choose the quieter path and to know what you'll need to clean up.

Before acting, answer three questions

1. Detection — what telemetry does this generate? Which Sigma/EDR rule would catch it? (Each domain skill's OPSEC & Detection table has this.) Pick the lower-noise variant when one exists.
2. Cleanup — what does this touch (files, registry, services, accounts, tickets)? How is it reverted? Stage the cleanup before you create the artifact.
3. Secret hygiene — any captured traffic / output that reaches the model or the report must be redacted at the boundary: python skills/coding-mastery/scripts/_lib/redact_headers.py < exchange.txt (or redact_text()), so Authorization/Cookie/API-key/JWT values never land in context or the report.