While thinking of ways to eliminate secrets in Terraform state [ref] someone mentioned to me that you could somehow filter them with Pulumi, so that they are not written to state at all. But I can't find the specifics of how to do that now, can someone give me some specifics on it?

I'm not sure about filtering out, but they're stored encrypted in state. If a resource doesn't mark things as sensitive correctly, you can use this for outputs: https://www.pulumi.com/docs/concepts/options/additionalsecretoutputs/ There's more details on marking inputs as secrets here: https://www.pulumi.com/docs/concepts/secrets/