AN ALLOW-LIST, AND THIS IS A PRIVILEGE BOUNDARY RATHER THAN TIDINESS. KV is operator-writable, so
merging an arbitrary object into the environment would let anyone with KV write set
PW_DIAGNOSTICS=1 -- which reaches /sql (arbitrary SQL against the site database) and
/restore (a whole-database overwrite). Every name here is a performance lever whose worst case
is a slow site; nothing here changes what is reachable.
PLAN is deliberately absent: it has its own key and its own resolver, because it selects a whole
profile rather than one number.
The ONLY env names KV may override.
AN ALLOW-LIST, AND THIS IS A PRIVILEGE BOUNDARY RATHER THAN TIDINESS. KV is operator-writable, so merging an arbitrary object into the environment would let anyone with KV write set
PW_DIAGNOSTICS=1-- which reaches/sql(arbitrary SQL against the site database) and/restore(a whole-database overwrite). Every name here is a performance lever whose worst case is a slow site; nothing here changes what is reachable.PLANis deliberately absent: it has its own key and its own resolver, because it selects a whole profile rather than one number.