What is the risk of accidentally logging or exposing environment variables that contain secrets, and how do you prevent it?

Environment variables containing secrets (database passwords, API keys) can accidentally leak through overly broad logging (like logging the entire process.env object for debugging), error messages that include configuration in a stack trace, or a debug/health endpoint that inadvertently returns configuration details -- prevention includes never logging process.env wholesale, explicitly redacting sensitive keys in any logging middleware, and being deliberate about exactly what a diagnostic endpoint exposes.

// Risky: logs every environment variable, including secrets
console.log(process.env);

// Safer: explicitly allowlist only non-sensitive values for diagnostic logging
console.log({ nodeEnv: process.env.NODE_ENV, port: process.env.PORT });

// A logging library redaction config
const logger = pino({ redact: ['req.headers.authorization', 'password'] });