# OpenTofu hardener

Run `av harden opentofu` to apply this hardener and `av doctor opentofu` to verify it.

`av harden opentofu` uses an Automic Vault-signed, Hardened Runtime OpenTofu
Isotope because the upstream macOS executable is only ad-hoc signed. Terraform
and OpenTofu share the upstream credential-helper protocol and hostname-bound
Secret Values, but keep separate Target identities and Secret Gates.