Lab: watch a secret cross into a process you did not write

The previous lesson put a secret in an environment variable and called it better than a file, which it is. This lab is about the cost that comes with it, and it is a cost people are consistently surprised by.

1. 1

   Set a credential in the environment and spawn a child process that you did not write.

   bash Copy

   cat > /tmp/inherit.py <<'EOF'
   import os, subprocess
   
   print("parent has API_TOKEN:", bool(os.environ.get("API_TOKEN")))
   
   child = subprocess.run(
       ["python3", "-c",
        "import os; print('child sees:', os.environ.get('API_TOKEN'))"],
       capture_output=True, text=True)
   print(child.stdout.strip())
   EOF
   API_TOKEN=sk-live-INHERITED python3 /tmp/inherit.py

2. 2

   The child never asked for it and received it anyway.

   text Copy

   parent has API_TOKEN: True
   child sees: sk-live-INHERITED

3. 3

   Clean up.

   bash Copy

   rm /tmp/inherit.py

Environment variables are inherited by default. That is the whole mechanism, and it is why the environment is convenient: you set it once and everything downstream can use it. The consequence is that everything downstream can use it.

• Every subprocess inherits your whole environment: a build step, a linter, a test runner, an npm postinstall script, a crash reporter.
• So does anything they spawn, all the way down. There is no depth limit and no audit trail.
• Anything that serialises the environment into a bug report ships the credential with it, which is how secrets reach error trackers without any log line naming them.