frep
frep copied to clipboard
Do not use environment variables by default - security issue
Please exclude support for environment variables in the templates (the .Env.* insertions according to the documentation). This can expose a lot of unintentional information (just run set in your shell to see what is available).
Preferred behaviour:
- Change default value of
--no-sys-envtotrue(or rename option). - Remove all support for system environments and only accept definitions from
--env,--jsonor--load.
Simple work around is to add --no-sys-env parameter.
This will bring to backward compatibility problems, need update in next major version release.