The real risk, surfaced per PR
PlanGuard reads the Terraform plan for every pull request and calls out what actually bites — destroys, forced replacements, IAM and network changes — before anyone hits merge.
Terraform change review · pull requests
Know the blast radius before you apply.
PlanGuard reads the Terraform plan on every pull request and surfaces the real risk in the change — destroys, replacements, permission and network shifts — before it merges. It reviews the change; you keep the apply.
What it does / 01
The risk in the change,
before the merge.
PlanGuard is a reviewer, not an applier. It tells you what a plan will really do — then hands the decision back to your team.
The plan, explained in plain language
No scrolling a thousand-line diff. Each change is summarised in words a reviewer can act on: what resource, what happens to it, and why it counts as risk.
Guardrails you configure
Set the policies that matter to your team — block on destroys, flag public ingress, require a second reviewer past a blast-radius threshold — and PlanGuard enforces them on the PR.
You keep the apply
PlanGuard reviews the change; it never holds your credentials and never runs terraform apply. The plan stays in your CI, the decision stays with your team.
What it checks / 02
Every plan,
read for risk.
PlanGuard scans the plan for the changes that actually cause outages and blast radius — the ones a diff makes easy to miss.
- Destroys
- Forced replacements
- IAM & permission changes
- Blast radius
Open source · MIT
Review the plan. Keep the apply.
Get PlanGuard ↗
A Theorvane product · your credentials never leave your CI