Infracost v0.10.45 fixes Terraform token disclosure vulnerability

Infracost has addressed a security issue in its Terraform Cloud and registry integration, as detailed in the GitHub Security Advisory database. The vulnerability involved sensitive token exposure due to unvalidated hostnames extracted from scanned Terraform files. This could lead to tokens being attached to requests sent to untrusted endpoints. The issue was resolved in version v0.10.45 by restricting token usage to trusted hosts only, ensuring that tokens are not sent to unverified destinations.

Operators should carefully review their CI configurations before upgrading. The vulnerability primarily affects setups using `pull_request_target` or similar configurations that provide tokens alongside untrusted Terraform content. If your environment uses `on: pull_request`, the documented configuration, tokens are not exposed in fork pull requests. However, if you rely on `pull_request_target` or another workflow that processes untrusted content with secrets, ensure that your CI system and Infracost configuration are hardened against this type of exposure. Additionally, verify that Terraform Cloud and registry tokens are not inadvertently included in runs that process untrusted pull requests.