secret

Documentation

Overview

Package secret holds the canonical secret-env-key predicate shared by every site that filters or redacts environment variables before they reach a child process or an exported config. Keeping ONE list prevents the divergence that let a bare *_KEY (e.g. PRIVATE_KEY) be redacted on one path and leak on another (audit finding B-09).

Index

• func IsSecretEnvKey(name string) bool

Functions

func IsSecretEnvKey

func IsSecretEnvKey(name string) bool

IsSecretEnvKey reports whether an environment variable name looks sensitive (case-insensitive substring match against secretEnvMarkers). It is a best-effort hygiene denylist, not a security boundary: callers strip or mask matching keys before a child process or an exported profile can observe them.