Severity: P0 — Bug
Where: src/core/env.ts:40-46 (writeEnv, used by applyTemplateEnv and wireApiEnv)
Problem
Values are written as bare ${k}=${v}. A managed API_SERVICE_TOKEN, or a user-pasted OAuth secret, containing #, whitespace, or a newline produces a .env that dotenv mis-parses (truncated at #/space). Inconsistent with src/generators/docker/docker.ts:writeEnvFile, which at least quotes multiline values.
Suggested fix
Quote/escape values consistently (single source of truth for env writing). Add tests for values containing #, spaces, quotes, and newlines.
Filed from an internal code audit (2026-07). File references are against main at audit time.
Severity: P0 — Bug
Where:
src/core/env.ts:40-46(writeEnv, used byapplyTemplateEnvandwireApiEnv)Problem
Values are written as bare
${k}=${v}. A managedAPI_SERVICE_TOKEN, or a user-pasted OAuth secret, containing#, whitespace, or a newline produces a.envthat dotenv mis-parses (truncated at#/space). Inconsistent withsrc/generators/docker/docker.ts:writeEnvFile, which at least quotes multiline values.Suggested fix
Quote/escape values consistently (single source of truth for env writing). Add tests for values containing
#, spaces, quotes, and newlines.Filed from an internal code audit (2026-07). File references are against
mainat audit time.