wrangler dev: secrets from --env-file are inherited by the workerd process environment

[schalkneethling]

Summary

In local dev, the secret values that Wrangler loads from --env-file (or .dev.vars / .env) end up in the environment of the workerd processes that Miniflare starts. Workers receive bindings through the Miniflare configuration, not through the workerd process environment, so this copy looks unnecessary. It makes the values visible wherever a process environment is visible, for example ps -E for the same user, and process inspection tools.

Versions

wrangler 4.147.0, miniflare 5.20261001.0-alpha, macOS 27.0.1, Node 24.21.0.

How it happens

1. Wrangler merges the env files into its own environment: process.env = loadDotEnv(resolvedEnvFilePaths, { includeProcessEnv: true, silent: true }) (wrangler-dist/cli.js, during argument checks for dev). With secrets.required configured, it logs "Using secrets defined in process.env".
2. Miniflare's Runtime.updateConfig starts workerd with env: { ...process.env, TZ: "UTC", FORCE_COLOR, ...options.runtimeEnv } (miniflare/dist/src/index.js).

So every value from the env files becomes part of workerd's environment.

Reproduction

1. Configure "secrets": { "required": ["MY_SECRET"] } and put MY_SECRET in an env file, or pass it with --env-file. For example, varlock's varlock-wrangler dev passes it through a FIFO, so it is never on disk.
2. Run wrangler dev.
3. ps -E -p <workerd pid> -ww -o command= contains the secret value. The Worker also receives it correctly as env.MY_SECRET.

Suggestion

Start workerd with an allowlisted environment (for example PATH, HOME, TZ, FORCE_COLOR, proxy and certificate variables, plus options.runtimeEnv) instead of the full process.env. Or at least remove the keys that Wrangler loaded from env files. I don't know which variables workerd relies on, so the allowlist needs input from the maintainers.

Impact

Low: local development only, and on most systems only the same user or root can read another process's environment. It removes one more copy of each secret, though. Tools that are careful to keep secrets off disk and out of process arguments (such as varlock's FIFO) currently lose that guarantee one step later.