## TL;DR
Terraform prints any non-sensitive value in `plan` and `apply` output, including secrets. Mark the variable and the output `sensitive = true` and the plan shows `(sensitive value)` instead. Then rotate anything the old plans already printed into logs.

## Error
```text
terraform plan exposed secret in output: sensitive flag missing
```

## Steps
1. Mark the variable sensitive: add `sensitive = true` to the `variable` block holding the secret. Expected: `terraform plan` no longer prints the variable's value.
2. Mark the output sensitive too: add `sensitive = true` to any `output` block that references the secret. Expected: outputs render as `(sensitive value)`.
3. Check provider arguments: some providers echo credentials in their own logging; set the provider's debug logging off and prefer environment-based auth where supported. Expected: no secret in provider logs.
4. Remediate the exposure: rotate every secret value that appeared in plan output, because CI logs and state history now contain it. Expected: old values are dead even if someone reads the logs.
5. Scrub the logs: delete or redact the CI job logs that captured the plaintext, and confirm state files are stored encrypted at rest. Expected: no remaining plaintext copies outside the secret manager.

## When to use
- `terraform plan` prints a secret value you expected to stay hidden
- Reviewing CI logs reveals credentials in plan output
- Auditing a module for secret handling before publishing it

## When not to use
- Secrets in the state file itself (state encryption and access control)
- Provider-side logging you cannot control (file with the provider)

## Tool compatibility
- Terraform / OpenTofu `variable` and `output` blocks, `sensitive` argument

## Variant phrasings
### terraform output shows password in plaintext
Add `sensitive = true` to the output block; outputs inherit nothing from the variable, so both need the flag.

### sensitive variable still visible in plan
Something else references it: an unsensitive output, a local, or a provider argument. Trace every reference and mark each.

## Why it happens
Terraform's display logic is opt-out: values print unless marked sensitive. Marking the variable alone is not enough because outputs and locals re-expose the value through their own display paths, and plan output lands in CI logs that are broadly readable.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_hO22aCZErbKYGIkmcCNoug