diff --git a/README.md b/README.md
index 14ed633..a39d859 100644
--- a/README.md
+++ b/README.md
@@ -106,7 +106,7 @@ to pin it — both take precedence over auto-detection.
 
 ## Demo
 
-`examples/demo` contains a small AWS config. Run `terraform init && terraform plan -out=tfplan && terraform show -json tfplan > .stackcanvas/plan.json` there and open the canvas to see create-highlighting. `plan` does not create or modify any resources — nothing is provisioned until `terraform apply` (note: the AWS provider still needs credentials and makes read-only API calls during plan).
+`examples/local-demo` is a **zero-credential** playground: `terraform init && terraform apply -auto-approve` creates real state using only local providers (no cloud account touched), and the canvas renders it — including sensitive masking on the generated password. `examples/demo` contains a small AWS config. Run `terraform init && terraform plan -out=tfplan && terraform show -json tfplan > .stackcanvas/plan.json` there and open the canvas to see create-highlighting. `plan` does not create or modify any resources — nothing is provisioned until `terraform apply` (note: the AWS provider still needs credentials and makes read-only API calls during plan).
 
 ## Telemetry
 
diff --git a/examples/local-demo/main.tf b/examples/local-demo/main.tf
new file mode 100644
index 0000000..26fbff3
--- /dev/null
+++ b/examples/local-demo/main.tf
@@ -0,0 +1,22 @@
+# Zero-credential demo: real Terraform state without touching any cloud.
+# terraform init && terraform apply -auto-approve   — safe, creates local files only.
+terraform {
+  required_providers {
+    random = { source = "hashicorp/random" }
+    local  = { source = "hashicorp/local" }
+  }
+}
+
+resource "random_pet" "app_name" {
+  length = 2
+}
+
+resource "random_password" "db_password" {
+  length  = 16
+  special = false
+}
+
+resource "local_file" "config" {
+  filename = "${path.module}/generated/config.txt"
+  content  = "app=${random_pet.app_name.id}"
+}