feat: per-item leak-detection opt-out via `@sensitive={preventLeaks=false}` by theoephraim · Pull Request #783 · dmno-dev/varlock

theoephraim · 2026-06-15T04:56:51Z

What

Lets a user opt a single secret out of runtime leak detection while keeping it sensitive everywhere else. Motivating case: an API endpoint that legitimately returns a secret to another system — today that trips varlock's response leak scanner.

# @sensitive={preventLeaks=false}
TOKEN_FORWARDED_TO_PARTNER=

The opt-out is leak-detection only — the value is still redacted in logs. Leak detection and log redaction previously shared one secrets map; this decouples them per-secret (the scanner skips opted-out entries, redaction still masks them).

The `@sensitive={...}` options form

option	type	default	meaning
`enabled`	boolean	`true`	whether the item is sensitive. May be a function for dynamic control (`enabled=forEnv(production)`); `{enabled=false}` ≡ `@sensitive=false`.
`preventLeaks`	boolean	`true`	when `false`, excluded from the response leak scanner (still redacted in logs).

# sensitive only in production, and allowed to leave the system
# @sensitive={enabled=forEnv(production), preventLeaks=false}
PARTNER_TOKEN=

How it flows

Schema → @sensitive={…} parses to an object literal.
Graph (config-item.ts) → reads enabled (→ sensitivity) and preventLeaks onto the item; rejects invalid uses (@public={…}, unknown option, non-boolean, array literal, bare @sensitive(…)).
Serialization (env-graph.ts) → emits preventLeaks: false only when opted out.
Runtime (runtime/env.ts) → scanForLeaks skips opted-out secrets; redactSensitiveConfig still masks them.

New syntax: `{}` / `[]` literals

Carrying options on @sensitive required a value syntax. We chose distinct brackets — {key=value} objects and [a, b, c] arrays — keeping () reserved for function calls. Rationale (mainstream langs keep objects in {} not (); Lisp's all-() was walked back by Clojure; ML-family records already use {k=v}). Usable as decorator values and function-call args, including nested (fn(retry={count=3})).

Guidance on when to use literals vs. not (don't wrap a function's own named args) is documented in the env-spec reference and a grammar DESIGN NOTE.

Deliberately deferred (documented)

Standalone literals as item values (FOO={…}) — gated on object/array value handling (coercion/validation/redaction-of-objects), not a blocker but its own change.
Multi-line literals.

Tests

Parser: object/array literal parse, nesting, round-trip.
env-graph: opt-out keeps item sensitive + serializes the flag; static + dynamic (forEnv) enabled; rejection cases.
Runtime: opted-out value passes the scanner, other secrets still throw, opted-out value still redacted.

All green: varlock + @env-spec/parser suites, typecheck, lint. Changeset included (minor for both packages).

cloudflare-workers-and-pages · 2026-06-15T04:57:26Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	varlock-docs-mcp	`42010ea`	Jun 15 2026, 04:57 AM

cloudflare-workers-and-pages · 2026-06-15T04:58:42Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	varlock-website	`0bc883b`	Commit Preview URL Branch Preview URL	Jun 15 2026, 06:06 PM

@sensitive

…lse} Secrets that legitimately leave the system (e.g. an API endpoint that returns a secret to another service) can opt out of runtime leak detection while still being redacted in logs, via the @sensitive options form. Adds standalone object ({key=value}) and array ([a, b, c]) literals to the env-spec grammar, usable as decorator values and function-call arguments (including nested). () remains reserved for function calls. Standalone literals as item values and multi-line literals are intentionally not enabled yet.

@sensitive

Lets the object options form toggle sensitivity itself (defaulting to true), including dynamically via a function — e.g. @sensitive={enabled=forEnv(production), preventLeaks=false}. Restores dynamic sensitivity control that was otherwise unavailable once using the {...} form.

philmillman

🚢

…dvisories All vulnerable instances are transitive, so overrides are the only deterministic fix. vite bounded <8 to stay on the 7.x line used by astro/cloudflare. esbuild override already present.

github-actions · 2026-06-15T19:32:18Z

The changes in this PR will be included in the next version bump.

Minor releases

@env-spec/parser 0.3.5 → 0.4.0
varlock 1.6.1 → 1.7.0

Bump files in this PR

sensitive-prevent-leaks-opt-out.md (view diff) (edit)

Click here if you want to add another bump file to this PR

This comment is maintained by bumpy.

socket-security · 2026-06-15T19:32:24Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/vite@7.3.2 ⏵ 7.3.5	⁺¹	⁺¹⁸	⁺¹	⁺²

View full report

socket-security · 2026-06-15T19:32:25Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `js-yaml` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `npm/agents@0.3.10` → `npm/@vscode/vsce@3.9.1` → `npm/@astrojs/starlight@0.39.2` → `npm/@astrojs/mdx@5.0.6` → `npm/astro@6.3.6` → `npm/@kubernetes/client-node@1.4.0` → `npm/js-yaml@4.2.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/js-yaml@4.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

pkg-pr-new · 2026-06-15T19:37:33Z

Open in StackBlitz

npm i https://pkg.pr.new/@env-spec/parser@783

npm i https://pkg.pr.new/varlock@783

commit: 34b6f1c

github-actions Bot added maintainer core:website core:varlock core:parser labels Jun 15, 2026

theoephraim mentioned this pull request Jun 15, 2026

feat: per-item leak-detection opt-out via @sensitive={preventLeaks=false} #778

Closed

theoephraim added 2 commits June 15, 2026 11:01

theoephraim force-pushed the sensitive-prevent-leaks-opt-out branch from 42010ea to f22d068 Compare June 15, 2026 18:02

docs: caution against casual use of @sensitive preventLeaks=false

0bc883b

philmillman approved these changes Jun 15, 2026

View reviewed changes

fix(deps): override vite/form-data/js-yaml + bump ws to clear audit a…

34b6f1c

…dvisories All vulnerable instances are transitive, so overrides are the only deterministic fix. vite bounded <8 to stay on the 7.x line used by astro/cloudflare. esbuild override already present.

theoephraim merged commit a0fadf7 into main Jun 15, 2026
27 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: per-item leak-detection opt-out via `@sensitive={preventLeaks=false}`#783

feat: per-item leak-detection opt-out via `@sensitive={preventLeaks=false}`#783
theoephraim merged 4 commits into
mainfrom
sensitive-prevent-leaks-opt-out

theoephraim commented Jun 15, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 15, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

philmillman left a comment

Uh oh!

github-actions Bot commented Jun 15, 2026

Uh oh!

socket-security Bot commented Jun 15, 2026

Uh oh!

socket-security Bot commented Jun 15, 2026

Uh oh!

pkg-pr-new Bot commented Jun 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

theoephraim commented Jun 15, 2026

What

The @sensitive={...} options form

How it flows

New syntax: {} / [] literals

Deliberately deferred (documented)

Tests

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 15, 2026

Deploying with Cloudflare Workers

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

philmillman left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jun 15, 2026

Minor releases

Bump files in this PR

Uh oh!

socket-security Bot commented Jun 15, 2026

Uh oh!

socket-security Bot commented Jun 15, 2026

Uh oh!

pkg-pr-new Bot commented Jun 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

The `@sensitive={...}` options form

New syntax: `{}` / `[]` literals

cloudflare-workers-and-pages Bot commented Jun 15, 2026 •

edited

Loading