A web application is deployed with Terraform (Infrastructure as Code). A developer hardcodes the database password in the Terraform configuration file and commits it to a public GitHub repository. What is the correct approach?

• A.Store the password in a terraform.tfvars file committed alongside the code, then mark the variable sensitive = true: Terraform hides it from plan output and state, and the repository never exposes the value to readers who clone it, a layout that keeps the secret out of plan output for reviewers of the pull request on the main branch
• B.Rewrite the Git history with git filter-repo to remove the file, then keep the password in the code: a force-push removes every fork and clone of the repository, and no rotation of the credential is needed afterwards, a cleanup that also covers the mirrors kept by external contributors on other hosting platforms of the project
• C.Base64-encode the password in the .tf file, an encoding that Terraform decodes at apply time: GitHub secret scanning cannot decode it, and every crawler skips encoded strings in public repositories of any size, an approach that keeps the credential unreadable to the public without a vault or any protection for the state file