Disabling or restricting `pm2 env` command
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 43.3k
- Forks
- 2.7k
- PR merge metrics
- No merged PRs in 30d
Description
We're being very careful about not leaking credentials on our infrastructure, so we use encryped env files (decrypt, set variables, run long-living app, then unset variables). So a different login won't have access to env variables (not set in .profile).
Problem is pm2 env exposes the env variables to any login session.
Is there any way to disable or restrict pm2 env?
Thanks
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the pm2 env command and how it exposes environment variables to other login sessions. Determine what restriction or disabling behavior is intended, then define tests that verify credentials are not exposed to unauthorized sessions. Done means the requested access control is clearly specified and verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100