From 6520828dcea6d1f08a18ada607bd7bbda98c5910 Mon Sep 17 00:00:00 2001
From: kp <pshenok.dev@gmail.com>
Date: Mon, 13 Jul 2026 14:03:14 -0700
Subject: [PATCH] docs: zero-credential local demo (#launch)

---
 README.md                   |  2 +-
 examples/local-demo/main.tf | 22 ++++++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 examples/local-demo/main.tf

diff --git a/README.md b/README.md
index 14ed633..a39d859 100644
--- a/README.md
+++ b/README.md
@@ -106,7 +106,7 @@ to pin it — both take precedence over auto-detection.
 
 ## Demo
 
-`examples/demo` contains a small AWS config. Run `terraform init && terraform plan -out=tfplan && terraform show -json tfplan > .stackcanvas/plan.json` there and open the canvas to see create-highlighting. `plan` does not create or modify any resources — nothing is provisioned until `terraform apply` (note: the AWS provider still needs credentials and makes read-only API calls during plan).
+`examples/local-demo` is a **zero-credential** playground: `terraform init && terraform apply -auto-approve` creates real state using only local providers (no cloud account touched), and the canvas renders it — including sensitive masking on the generated password. `examples/demo` contains a small AWS config. Run `terraform init && terraform plan -out=tfplan && terraform show -json tfplan > .stackcanvas/plan.json` there and open the canvas to see create-highlighting. `plan` does not create or modify any resources — nothing is provisioned until `terraform apply` (note: the AWS provider still needs credentials and makes read-only API calls during plan).
 
 ## Telemetry
 
diff --git a/examples/local-demo/main.tf b/examples/local-demo/main.tf
new file mode 100644
index 0000000..26fbff3
--- /dev/null
+++ b/examples/local-demo/main.tf
@@ -0,0 +1,22 @@
+# Zero-credential demo: real Terraform state without touching any cloud.
+# terraform init && terraform apply -auto-approve   — safe, creates local files only.
+terraform {
+  required_providers {
+    random = { source = "hashicorp/random" }
+    local  = { source = "hashicorp/local" }
+  }
+}
+
+resource "random_pet" "app_name" {
+  length = 2
+}
+
+resource "random_password" "db_password" {
+  length  = 16
+  special = false
+}
+
+resource "local_file" "config" {
+  filename = "${path.module}/generated/config.txt"
+  content  = "app=${random_pet.app_name.id}"
+}