Really appreciate netlify’s mission on making our dev life easier.
Handling env vars and secret API keys can be challenging, that’s why you suggest to put sensitive vars into the Netlify’s env UI interface so only admin level users can see/change these instead of everyone with access to the repo.
However, your netlify.toml file uses a hierarchical override, which makes it super easy for non-authorized devs with access to any branch to extract production level API keys.
They only need to delete the branch overrides in the config file, and print the values somewhere in the code of their local build.
Done, all secrets revealed.
I would urge netlify to add restrictions in the admin UI to avoid trickling production keys down stream, make env keys independent of each other or use a reverse hierarchal order where the lowest level keys are overridden by the highest (highest being netlify UI) to avoid this security leak.
PS: Netlify dev: ‘◈ Reloading redirect rules from [ ‘netlify.toml’ ]’ is logged, however netlify dev needs a full restart for effects in the config file to take effect