Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Leaked content of comments when `debug: true`

See original GitHub issue

Given this configuration

require('dotenv').config({ debug: true })

and this .env

#Local
DATABASE_URL=postgresql://user:password@localhost:5432/database
#Production
#DATABASE_URL=postgresql://user:password@pg-db-provision.id.eu-central-1.rds.amazonaws.com:5432/database

Dotenv output will show

[dotenv][DEBUG] did not match key and value when parsing line 1: #Local
[dotenv][DEBUG] did not match key and value when parsing line 1: #Production
[dotenv][DEBUG] did not match key and value when parsing line 1: #DATABASE_URL=postgresql://user:password@pg-db-provision.id.eu-central-1.rds.amazonaws.com:5432/database

Leaking the secret into the logs 😨

I see a PR who could solve this, has been open and then closed, about removing comments from the DEBUG logs https://github.com/motdotla/dotenv/pull/404 @maxbeatty What do you think about this with this new light?

(Context: https://github.com/prisma/prisma/issues/9428)

Issue Analytics

State:
Created 2 years ago
Comments:7 (4 by maintainers)

Top GitHub Comments

3reactions

motdotlacommented, Jan 11, 2022

The debug feature needs a fresh pass. It’s being used for a different reason than it was originally intentioned.

1_pMk3h0dIYMb_I1iJCjriPQ

We will improve it soon. It includes requests here as well:

3reactions

maxbeattycommented, Nov 5, 2021

I don’t participate in maintaining this repository anymore, but you asked what I think so I’ll tell you I think you’re solving the wrong problem 😸 The intention of the debug option for dotenv is to help understand why you might not be getting the expected values assigned to process.env. It is not intended as a general logging tool.

The problem you should be solving is how to separate your local and production secrets so they are not together in the same file. I know it’s easier, but it’s also less secure. Ideally, your production and other hosted environments don’t use .env files at all. There are lots of great secure secret management tools out there. Further, I wouldn’t allow connections to RDS outside of a VPC, but I digress.

Good luck! Hope you all find a solution that works for everyone ✌🏼