terraform plan output leaks secrets into the log

A plan prints the values it intends to write, and a pipeline that posts the plan to a pull request posts them to anybody who can see the repository.

# in the plan output
  + database_password = "hunter2-real-one"

# marking the variable stops that
variable "database_password" {
  type      = string
  sensitive = true
}

  + database_password = (sensitive value)

# and the state file still contains it in plaintext.

sensitive suppresses the value in plan and apply output and does nothing about the state file, which holds every value in plain text and is the reason state must live somewhere with access control and encryption at rest. A pipeline that uploads the plan as an artifact is subject to the same problem as one that comments it. The sensitivity marking also propagates to any output derived from the value, which occasionally makes an unrelated output unreadable and is the correct behaviour.