environment-variables
Safeguard articles tagged "environment-variables" — guides, analysis, and best practices for software supply chain and application security.
7 articles
Seventeen Fake Payment SDKs, Six Minutes to Detection, and a Sandbox Check
On 7 July 2026, roughly 17 typosquatted payment-provider packages hit npm and PyPI — paysafe-checkout, paysafe-node, neteller and friends. They swept environment variables matching KEY, SECRET, TOKEN, PASS, AUTH and API, explicitly hunted AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN and NPM_TOKEN, and exited quietly if they thought they were in a sandbox.
The Risks of Secrets in Environment Variables (2026)
Environment variables feel like the safe place to put secrets — but they leak through crash dumps, child processes, CI logs, and container layers. Here is where env-var secrets escape and what to do instead.
Setting JAVA_HOME on Ubuntu: A Step-by-Step Guide
How to set JAVA_HOME on Ubuntu correctly and permanently: find your JDK path, choose the right scope (user vs system), handle multiple JDKs with update-alternatives, and verify it stuck.
The Vercel Breach: A Forgotten OAuth Grant Became a SaaS Supply-Chain Pivot (May 2026)
An infostealer infection at AI startup Context.ai let attackers reuse a Vercel employee's months-old Google Workspace OAuth grant to bypass MFA and exfiltrate customer environment variables. Disclosed April 2026, the fallout deepened through May.
dotenv npm: A Security Review and Safe Usage Guide
The dotenv npm package loads environment variables from a .env file into process.env. It is safe and widely used, but how you handle the file around it is where most mistakes happen.
Environment Variable Injection in CI/CD Pipelines
Environment variables in CI/CD systems carry secrets, configuration, and control flow. When attackers can inject or modify them, everything breaks.
Environment Variable Injection in CI/CD: The Invisible Attack Surface
CI/CD pipelines trust environment variables implicitly. Injecting or modifying them can hijack builds, steal secrets, and compromise deployments.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.