A variable which appears sensitive (e.g. it has a name like "password" or "api_key") has a default value set, which may mean a sensitive value like a password is stored in plain text inside your Terraform code. A good practice is to use environment variables containing sensitive data mapped to terraform variables.