That's right, which is why they usually recommend not committing tfstate but using some remote backend. We've gotten away without that because the APIs we use

That's right, which is why they usually recommend not committing tfstate but using some remote backend. We've gotten away without that because the APIs we use don't contain any secrets. (The auth token for making the requests is just an environment variable.)