Committed Terraform plan file exposed secrets via git history, prompting credential rotation

A developer accidentally committed a Terraform plan file named 'out' to a private repository, where it sat on the remote for nine days. Existing protections such as .gitignore rules and secret scanners relied on filenames and text matching, so they failed to flag the binary zip archive. Because a plan file bundles the full Terraform state and all input variables, it contained far more sensitive data than the planned changes alone, including credentials for many resources. The author describes the difficulty of identifying and rotating those secrets across multiple environments and providers. The post warns that targeting a plan does not limit what gets saved, and that sensitive-value redaction in Terraform's display output is not encryption.