mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Add a design spec for scrubbing sensitive environment variables from package-manager child processes, mirroring the DANGEROUS_FILES model: built-in default deny list, per-profile allow overrides, enforced at the ApplySandbox chokepoint. Motivated by the Miasma/Shai-Hulud toolkit's env-based credential harvesting. https://claude.ai/code/session_017Da1sAYLYpeEgogm6f9VYW