I'm hoping that Infracost doesn't need the entire state file shipped to an outside service/server, like the one mentioned here does.
State files should be considered secret....
$ terraform state pull | curl -s -X POST -H "Content-Type: application/json" -d @- https://cost.modules.tf/