Will It Vibe?Terraform state stored on the local backend
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
A local backend keeps terraform.tfstate as a plaintext file on disk. State routinely contains secrets (database passwords, generated keys) in clear text, and a local file has no encryption, locking, or access control.
Why it matters
A local backend keeps terraform.tfstate as a plain file on the machine that ran Terraform. State routinely contains secrets such as database passwords and generated keys in clear text, and a local file has no encryption at rest, no locking to prevent concurrent corruption, and no shared access control. For any team or production use this is a real exposure and reliability risk.
How to fix it
Move to a remote backend with encryption and locking, such as an S3 backend with encrypt = true and DynamoDB state locking, or Terraform Cloud. Restrict who can read the state bucket, since it holds secrets. Migrate existing state with terraform init once the backend is configured, and remove the local state file afterward.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo