Rules / GL062

GL062 `printenv` or bare `env` dumps all variables to the job log

Severity: warn
OWASP: CICD-SEC-6 – Insufficient Credential Hygiene
CWE: CWE-532 – Insertion of Sensitive Information into Log File

Risk

Running printenv or bare env in a CI script dumps every environment variable to the job log — including all CI/CD secrets, tokens, and masked variables. GitLab masks known secret variable values in logs, but masking is not guaranteed for all formats (short values, values with special characters, values that appear mid-line). Any third party with read access to the job log can potentially extract credentials.

GL021 already flags echo/printf of individual secret variables. This rule covers the broader pattern of dumping the entire environment.

Trigger example

debug:
  script:
    - printenv   # dumps all variables to the log
    - env

/usr/bin/env, and forms with shell separators (printenv && ..., cd /tmp; env), are also detected.

What is not flagged

printenv VAR_NAME — printing a specific variable (same risk class as echo, covered by GL021)
env VAR=value command — setting a variable for a subprocess
env python script.py — using env as a command runner

Safe alternative

Print only the specific variables needed for debugging:

debug:
  script:
    - echo "CI_COMMIT_REF=$CI_COMMIT_REF_NAME"
    - echo "DEPLOY_ENV=$DEPLOY_ENV"

Notes

Severity is warn.
Related: GL021 (individual secret printed via echo/printf), GL033 (CI_DEBUG_TRACE exposes all variables).
Script-line rule; assumes POSIX shell (see the README Shell assumptions note).
Suppress per-file with .glsec-ignore or inline # glsec:ignore GL062.

Documentation for glsec 1.23.0. Source of this page · Rule implementation

GL062 printenv or bare env dumps all variables to the job log