Hard to believe they left such an obvious security hole open for 6 months. Any random PR can access environment variables? That's concerning for a project with 20k+ stars.