Comment by nailer
12 hours ago
> you‘re one `printenv` or improperly written third party dependency that leaks env vars away from a security incident.
Game over already if anyone can run commands or arbitrary code. Not using the environment won't help you.
This was about a programmer accidentally adding a debug print, or say an error page helpfully dumping environment, or logs from a third party tool, etc. Not about someone actually getting RCE just to print the environment, of course.