# security guidelines for ansible role creators?

**URL:** <https://forum.ansible.com/t/security-guidelines-for-ansible-role-creators/20474>\
**Category:** Ansible Project\
**Created:** [February 6, 2016, 1:23pm UTC](https://forum.ansible.com/t/security-guidelines-for-ansible-role-creators/20474 "2016-02-06T13:23:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nusenu1](https://avatars.discourse-cdn.com/v4/letter/n/db5fbb/32.png) [@Nusenu1](https://forum.ansible.com/u/Nusenu1)\
**Post date:** [February 6, 2016, 1:23pm UTC](https://forum.ansible.com/t/security-guidelines-for-ansible-role-creators/20474/1 "2016-02-06T13:23:44Z")

</div>

Hi,

are there security guidelines for ansible role creators found somewhere  
that lists common security pitfalls that one should look at to avoid  
things like [1][2] and other such cases?

thanks!

[1][https://github.com/nusenu/ansible-relayor/commit/09f9afe7096395cb95310b8fb454c2b640ed17d9](https://github.com/nusenu/ansible-relayor/commit/09f9afe7096395cb95310b8fb454c2b640ed17d9)  
[2]  
[https://github.com/nusenu/ansible-relayor/commit/d0a969fabe731e8f20dad074ec772ec12faaab7b#diff-0ab2a3945984f21ca36ce37d625d716cR147](https://github.com/nusenu/ansible-relayor/commit/d0a969fabe731e8f20dad074ec772ec12faaab7b#diff-0ab2a3945984f21ca36ce37d625d716cR147)

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [February 6, 2016, 4:48pm UTC](https://forum.ansible.com/t/security-guidelines-for-ansible-role-creators/20474/2 "2016-02-06T16:48:23Z")

</div>

None Ansible specific, just follow good security practices you would  
with any other systems.  
Most of it boils down to validating and sanitizing your inputs and try  
to avoid injection by quoting and escaping as the context requires it.  
Also try to always use the least privilege needed and disclose as  
little information as possible.