Did your Terraform plan just print a secret in plaintext?

1. Load your plan

From a file (the JSON from terraform show -json -- read locally, never uploaded)

Check plan Load worked example Clear

2. What this plan would fail on

Prefer a CLI, or want this as a CI gate before you apply?

Same logic, zero dependencies, one file — run it right after you generate the plan, before anything applies:

terraform plan -out=tfplan && terraform show -json tfplan > plan.json
node cli.mjs check plan.json                    # human-readable, exit 1 if anything unmarked is found
node cli.mjs check plan.json --json

Get cli.mjs — Node 18+, nothing to install. It reads only the local file you name: no network call, ever.

What this checks — and what it cannot

Sources and the exact scope: why a Terraform plan can print a secret even though the schema has a `sensitive` flag. Already run a general secret scanner like Gitleaks, or a broader policy scanner like Checkov? See how this checker differs from Gitleaks, this checker vs. Checkov, or this checker vs. reading the plan JSON by eye — the short version is they all catch different things. Config drifting from what a codebase actually reads is a related, separate failure — see Env Example Drift Check for `.env.example` rather than a Terraform plan. And the same plan file answers a second question this tool does not ask: Terraform Plan Blast Radius Check reports what the apply would destroy or replace — every replace on a database, disk, bucket or secret, with the attribute that forced it.

Common questions

Does this catch every possible secret leak in my Terraform plan?

No. It matches a fixed set of high-confidence secret shapes — AWS access keys, PEM private keys, JWTs, and URLs with embedded credentials — against every attribute value the provider schema did not already mark sensitive. It will not catch a secret in a shape it doesn't recognise, and it cannot see your provider's source to know whether a field should have been marked sensitive in the first place. Treat a clean report as one more gate passed, not a guarantee.

Is my plan uploaded anywhere?

No. The browser page parses a pasted or locally loaded file entirely in your own browser and never sends it anywhere. The CLI reads only a local file — no network call, ever.

What file does it need?

The structured plan JSON from terraform show -json, not the human-readable terraform plan output and not the line-by-line terraform plan -json stream. Run: terraform plan -out=tfplan && terraform show -json tfplan > plan.json

Why doesn't the report show the actual secret value?

Because the report itself is meant to be pasted into an issue, a Slack message, or a CI log — doing that with the real value would recreate the exact leak this tool exists to catch. It shows the first and last four characters and which pattern matched, enough to find and rotate the value without re-exposing it.