BlastRadius catches the Terraform destroy hiding in your pull request

Field notes

BlastRadius runs against the Terraform plan file a CI workflow already creates, using terraform show -json rather than requiring a separate planning process. Its homepage describes redaction inside the runner, including Terraform-sensitive values and provider secret attributes, before anything is uploaded. The current rule set is AWS-focused and includes stateful replacement and security-group widening; each rule is checked against both a plan that should trigger it and one that should not.