A web application is deployed with Terraform (Infrastructure as Code). A developer hardcodes the database password in the Terraform configuration file and commits it to a public GitHub repository. What is the correct approach?

• A.Encrypt the Terraform file before committing
• B.Terraform automatically encrypts sensitive variables in the state file
• C.Use a private GitHub repository to secure the Terraform file
• D.Use a secrets management solution: store sensitive values in Vault, AWS Secrets Manager, or Azure Key Vault and reference them via data sources in Terraform. Never commit plaintext secrets to version control. Additionally, use terraform.tfvars or environment variables for sensitive inputs and add those files to .gitignore