Terraform State Secret Leak Lint

It reads the .tf file you have open and names every place a secret value ends up in terraform.tfstate in cleartext: resource attributes like password, the result of random_password, the PEM key from tls_private_key, secret data sources, outputs missing sensitive, and a backend written without encryption. 10 rules. Each finding says which line and what to do instead.

Platform and DevOps engineers who keep AWS, Azure or GCP infrastructure in Terraform, and the person who has to answer an auditor asking where production secrets live. It is most useful on a repo that grew fast, where several people added resources and nobody has read the state file end to end.

Free scanners look for a secret written in the code. This looks for the values Terraform copies out of the code and into terraform.tfstate, which is a different list: random_password.result, tls_private_key.private_key_pem and every secret data source are clean HCL that still land in state in cleartext. A code scanner passes that file.

Free, with no key: scan the file you have open against all 10 rules and read every finding with its line number and its fix. The licence key adds the workspace sweep, which scans every .tf file in one pass, and the export that writes the findings to a dated Markdown or JSON file you keep as audit evidence.

Hand review runs about $150/hour. Reading a mid-size Terraform repo attribute by attribute, checking each provider schema for what is persisted, and writing the result up as evidence is most of a day. The extension is $29 once, one licence key per person or CI seat, with a 7-day full refund.