Committing an API key to a repo is the nightmare every developer has had at least once. Most of us have a scanner, a hook and a .gitignore that are supposed to make it impossible. I never thought I would be writing this post. Then a Terraform plan file showed up in our git history.

A Terraform plan file is a zip archive. It does not care what you name it. Our .gitignore cared. Our secret scanner cared. Both were looking for *.tfplan , tfplan and plan , and the file that was committed was called out .

I ran it. I know the convention. The command I meant to type was terraform plan -out=tfplan . The command I typed was terraform plan -out=out . Terraform does not care. The file went in with the next git add . . The one small mercy: the repository is private. "Private" still means every engineer, every contractor and every CI runner with a clone had it.…