<p dir="auto">Is there a reason why allow-env does not support a whitelist?</p>
<p dir="auto">I like the idea of knowing explicitly what environment variables the program can access. Often a program should only be able to access a few variables such as <code class="notranslate">DEBUG</code>.</p>
<p dir="auto">Example invocation</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="DEBUG=* deno run --allow-env=DEBUG,TEST main.tsx"><pre class="notranslate"><code class="notranslate">DEBUG=* deno run --allow-env=DEBUG,TEST main.tsx
</code></pre></div>
<p dir="auto">Of course the current alternative is something like this:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="env -i HOME=$HOME PWD=$PWD PATH=$PATH DEBUG=* TEST=$TEST deno run --allow-env main.ts"><pre class="notranslate"><code class="notranslate">env -i HOME=$HOME PWD=$PWD PATH=$PATH DEBUG=* TEST=$TEST deno run --allow-env main.ts
</code></pre></div>
<p dir="auto">Currently <code class="notranslate">--allow-env</code> gives program unlimited permission to access any environment variable. It's much strong privilege and there should be more limited permission control for them.</p>
<p dir="auto">Like <code class="notranslate">--allow-net=:9999</code>, how about these? <code class="notranslate">--allow-env=DEBUG</code>, <code class="notranslate">--allow-env=DENO_DIR,DENO_INSTALL</code></p>
<p dir="auto"><code class="notranslate">Deno.env()</code> should also be re-designed to get permitted variables.</p>
<p dir="auto">I think even if full access to envars given to the process, It's dangerous to return key-value pair of all environment variables because malicious  attackers are able to  know  some secret informations if they don't know envar's name. So how about re-design <code class="notranslate">Deno.env</code> to immutable map-like object?</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="Deno.env.get(&quot;DENO_DIR&quot;)
Deno.env.set(&quot;DEBUG&quot;, &quot;*&quot;)
Deno.env.has(&quot;PORT&quot;)"><pre class="notranslate"><code class="notranslate">Deno.env.get("DENO_DIR")
Deno.env.set("DEBUG", "*")
Deno.env.has("PORT")
</code></pre></div>