IaC Bazaar

Free, no account

What vouches for this module?

Every Terraform platform checks the plan. The plan is generated by the code you are trying to check. Paste a module source and see what is actually known about the code itself.

Anything you would put in a source = line.

Or try one of these:

What this cannot tell you

This page reads public metadata. It does not download the module, does not read its code, and does not run it. A module can be perfectly pinned, perfectly signed, and still do something you would never allow.

What it does show is the gap: for most modules, nothing anywhere ties the code you are about to run to the person you think wrote it. A digest you pasted yourself does not close that gap, because you are the one who pasted it.

Closing it

Vizier refuses to run a module unless a key you trust signed the tree it actually fetched. Not the tag, not the digest you wrote down: the bytes that arrived.

How Vizier does it

Questions

Does a green result mean the module is safe?
No, and we never say that. This reports what a public API can tell us about how a source is pinned and whether a commit carries a signature GitHub recognises. It does not read the module code, does not run it, and cannot tell you whether the module does something you would not want.
My module is signed and you said nothing was found.
We list every check we ran underneath the result. If your signature lives somewhere we did not look, that is a limit of this page rather than a finding about your module. We would rather say we did not look than call you unsigned.
Why does a signed commit not help if I use a tag?
Because the tag is the part that moves. A signature says a key vouched for one commit; it says nothing about which commit your tag points at tomorrow. Anyone who can write to the repository can re-point a published tag, which is the documented Terraform Registry hijack.
Do you store what I paste?
No. The source you submit is used to build one read-only API call and is not written to any database.