Where: packages/safe-bash/src/shell/env-warning.ts:6 — if (env !== process.env) return; — the "you passed the host environment" warning fires only on object identity. packages/safe-bash/README.md ("Environment" section) says the shell detects passing the host environment.
PoC: construct three shells with console.warn counted:
new Shell({ fs, env: process.env }); // identity
new Shell({ fs, env: { ...process.env } }); // spread copy
new Shell({ fs, env: Object.assign(Object.create(null), process.env) }); // null-proto copyMeasured: identity=1 spread copy=0 Object.assign copy=0.
Impact: (a)/(e) — the common Workers/Node wiring mistake env: { ...process.env, EXTRA } (exactly the v1 finding-1 scenario, where nodejs_compat maps Worker secret bindings into process.env) produces no warning, while the README text overstates the guard.
Fix: also warn when the supplied env shares a large fraction of key/value pairs with process.env (or contains well-known secret-bearing keys such as *_TOKEN, *_SECRET, AWS_*), or reword the README to "warns only when the identical process.env object is passed".
Found in security audit v3 (2026-09-07).
Where:
packages/safe-bash/src/shell/env-warning.ts:6—if (env !== process.env) return;— the "you passed the host environment" warning fires only on object identity.packages/safe-bash/README.md("Environment" section) says the shell detects passing the host environment.PoC: construct three shells with
console.warncounted:Measured:
identity=1 spread copy=0 Object.assign copy=0.Impact: (a)/(e) — the common Workers/Node wiring mistake
env: { ...process.env, EXTRA }(exactly the v1 finding-1 scenario, wherenodejs_compatmaps Worker secret bindings intoprocess.env) produces no warning, while the README text overstates the guard.Fix: also warn when the supplied env shares a large fraction of key/value pairs with
process.env(or contains well-known secret-bearing keys such as*_TOKEN,*_SECRET,AWS_*), or reword the README to "warns only when the identicalprocess.envobject is passed".Found in security audit v3 (2026-09-07).