Test that environment-file values stay out of scanner reports

By Batu · English technical notes

Also published in our Blogger archive.

Direct answer

A regression test for name-only scanning needs a value that would be obvious if it leaked. The fixture writes a sentinel token to .env, builds a report from Path.name, and asserts that the sentinel is absent. That tests the privacy-relevant boundary directly instead of merely checking that a filename was found.

The edge case is a refactor that adds a convenient read_text() call for diagnostics. If that value reaches report formatting, the first assertion fails. The second assertion also fixes the intended report wording so accidental detail expansion is visible.

This example does not prove that every subsystem avoids environment values, classify all secret filenames, or protect values already loaded into memory. It covers a local scanner’s file-discovery path. Keep the sentinel test near that path whenever output formatting changes.

Complete example

from pathlib import Path
from tempfile import TemporaryDirectory

with TemporaryDirectory() as directory:
    root = Path(directory)
    env_file = root / ".env"
    env_file.write_text("TOKEN=never-report-this", encoding="utf-8")
    report = f"flagged={env_file.name} values_read=no"
    assert "never-report-this" not in report
    assert report == "flagged=.env values_read=no"
    print(report)

Expected stdout:

flagged=.env values_read=no

Sources

- pathlib documentation

Prepared with AI assistance. The example uses synthetic data; its stated limits apply.