GRAB Racem ac601b7e59 fix(security): remove startup secrets from the environment before child processes spawn ...

ARTEX_PG_DSN, ANTHROPIC_API_KEY and OPENAI_API_KEY are read only during
startup (server.NewManager and agent.FromEnv in server.New), but stayed in
the process environment. Agent shells, custom tools and MCP stdio servers
copy os.Environ() when they start, so they could read the database password
and the LLM keys. main now unsets the three variables right after server.New
returns.

2026-11-03 21:46:40 +01:00

..

artex

fix(security): remove startup secrets from the environment before child processes spawn

2026-11-03 21:46:40 +01:00