Module env
Source - DENIED_ENV_VARS 🔒
- Env var names that must never be overwritten by secret export.
Covers dynamic linker, shell execution, path hijack, and privilege escalation vectors.
- cmd_env 🔒
- cmd_export 🔒
- is_denied_env_var 🔒
- Returns true if
name is a denied env var (case-insensitive prefix match for BASH_FUNC_). - json_escape 🔒
- JSON-escape a string value.
- secret_key_to_env_var 🔒
- Transform a secret key name into an environment variable name.
- shell_escape 🔒
- Shell-escape a value for safe embedding in
export K="V".
Strips null bytes (C string truncation), escapes shell metacharacters.