Never sends your data
No telemetry, no accounts and no hosted service. Reports make no network requests and run under a strict content security policy.
Security and privacy
Secrets stay out, by design
Plans and state can contain secrets. tfviz is built so that only an approved, sanitised model of your infrastructure ever reaches the report.
How data moves through tfviz
Raw values never leave the reader. Everything after it works on a sanitised model.
- Plan or stateMay contain secrets
- ReaderTurns sensitive values into markers with no payload
- ProjectionKeeps only approved fields for each resource type
- ReportSanitised model in one offline HTML file
What tfviz never does
Never shows secret values
Passwords, user data, environment variables, tags, policies and secret contents are withheld. A sensitive change is shown only as changed or unchanged.
Never touches your state
S3 access is a single read-only request for the object you name. No listing, no writes, no state locks and no secret-value APIs.
Controls and evidence
| Risk | Control | Evidence |
|---|---|---|
| Secrets in the report | Payload-free sensitive markers, per-type allowlists, and a deny guard for secret-shaped names | Planted canary secrets are searched for in every report, stdout and stderr |
| Secrets revealed through relationships | A sensitive reference suppresses its relationship | Graph tests |
| Script injection from labels | Escaped, embedded JSON and text-only rendering | Hostile-label tests in three browsers, plus fuzzing |
| Network access from reports | Hash-based CSP with connect-src 'none' | Browser tests check zero requests |
| Other sites reading the local explorer | Loopback only, Host check, one-time token, SameSite=Strict cookie, no CORS | Server tests and a cross-origin browser test |
| Identifying details when sharing | --safe-share stand-ins; the mapping is never written | Safe-share leak tests |
| Supply chain | Pinned dependencies, licence allowlists, checksums, SBOMs and build provenance | CI and the release workflow |
Limits
- Normal reports are sensitive. They show approved names, IDs, ARNs and network details by design, so protect them like other infrastructure artefacts.
- Safe-share is not anonymity. The shape of your architecture may itself be confidential.
- Names can carry secrets. No heuristic can prove that an arbitrary name is harmless.
- Snapshots are not live. State and plans describe a recorded moment. Relationships are recorded associations, not observed traffic.
- tfviz can't clean your producer files. The exported JSON and Terraform's own plan files can contain plaintext secrets. Pipe the JSON instead of saving it.
Report a vulnerability
Please report security issues privately, as described in SECURITY.md. Never attach a real plan, state file or unredacted report to a public issue.