Module secrets 

Secrets Management

Utilities for safely loading and filtering environment variables as agent configuration secrets.

The primary entry point is load_safe_env_vars, which returns only non-sensitive environment variables. Sensitive variables (those matching known credential patterns) are filtered out to prevent accidental leakage into configuration files or logs.

For intentionally loading specific credentials, use is_env_var_safe to verify a variable name before loading.

Functions

is_env_var_safe

Returns true if the environment variable name is considered safe (i.e. does not match any blocked pattern).

load_env_var_safe

Load a single environment variable by name if it is safe.

load_safe_env_vars

Collect all safe environment variables into a HashMap.