frep
frep copied to clipboard
Do not use environment variables by default - security issue
Please exclude support for environment variables in the templates (the .Env.*
insertions according to the documentation). This can expose a lot of unintentional information (just run set
in your shell to see what is available).
Preferred behaviour:
- Change default value of
--no-sys-env
totrue
(or rename option). - Remove all support for system environments and only accept definitions from
--env
,--json
or--load
.
Simple work around is to add --no-sys-env
parameter.
This will bring to backward compatibility problems, need update in next major version release.