Environment Variables

Environment capture is powerful and risky. The safest default is to treat environment variables as sensitive unless a specific key is known to be harmless and useful.

Prefer an explicit deny list for:

• database credentials
• JWT or signing secrets
• API tokens
• private service URLs that encode credentials

If a deployment variable is needed for debugging, capture a derived value instead of the raw secret.