{"record":{"id":"5295430efd9c0c0b","repo":"dbt-labs/dbt-core","slug":"environment-variables-starting-with-dbt-internal","errorCode":null,"errorMessage":"Environment variables (starting with {DBT_INTERNAL_ENV_VAR_PREFIX}) cannot be accessed here","messagePattern":"Environment variables \\(starting with (.+?)\\) cannot be accessed here","errorType":"exception","errorClass":"minijinja::Error (InvalidOperation)","httpStatus":null,"severity":"error","filePath":"crates/dbt-jinja-vars/src/env_var.rs","lineNumber":64,"sourceCode":"\n    if let Some(value) = overrides_fn.and_then(|f| f(var)) {\n        return Ok(value);\n    }\n\n    let is_secret = var.starts_with(SECRET_ENV_VAR_PREFIX);\n    if is_secret && !placeholder_on_secret_access {\n        let err = Error::new(\n            ErrorKind::InvalidOperation,\n            format!(\n                \"Secret environment variables (starting with {SECRET_ENV_VAR_PREFIX}) \\\n                cannot be accessed here\"\n            ),\n        );\n        return Err(err);\n    }\n    let is_internal = var.starts_with(DBT_INTERNAL_ENV_VAR_PREFIX);\n    if is_internal {\n        let err = Error::new(\n            ErrorKind::InvalidOperation,\n            format!(\n                \"Environment variables (starting with {DBT_INTERNAL_ENV_VAR_PREFIX}) \\\n                cannot be accessed here\"\n            ),\n        );\n        return Err(err);\n    }\n\n    match (std::env::var(var), default) {\n        (Ok(value), _) => {\n            if is_secret {\n                debug_assert!(placeholder_on_secret_access);\n                let value = Value::from(SECRET_PLACEHOLDER.replace(\"{}\", var));\n                Ok(value)\n            } else {\n                if let Some(tracker) = tracker {\n                    tracker(var, &value);","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/dbt-labs/dbt-core/blob/0267ce9170576975b76b64ce856b2e5848e96617/crates/dbt-jinja-vars/src/env_var.rs#L46-L82","documentation":"Environment variables whose names start with `_DBT` are reserved for dbt's internal machinery and are blocked from Jinja `env_var` access. This prevents user code from reading or depending on internal state variables, whose names and semantics may change between dbt versions. The check runs unconditionally, before any environment lookup or default fallback.","triggerScenarios":"Calling `{{ env_var('_DBT_SOMETHING') }}` with any name matching the `_DBT` prefix from Jinja. Unlike the secret check, no flag disables this — even `placeholder_on_secret_access = true` still errors at env_var.rs:64.","commonSituations":"Curious users or copy-pasted code attempt to read internal dbt variables (e.g. `_DBT_INTERNAL_...`) discovered via `env | log` debugging; scripts that blanket-export many `_DBT_*` vars and expect them visible in models.","solutions":["Rename the variable so it does not start with `_DBT` and access it under the new name.","Stop depending on internal dbt variables; use documented public env vars or `flags`/`invocation_id` context members instead.","Pass the needed value explicitly as a dbt var (`--vars`) or a non-reserved environment variable."],"exampleFix":"// before (Jinja)\n{{ env_var('_DBT_INVOCATION_TMP_DIR') }}\n// after\n{{ env_var('MY_TMP_DIR', default='/tmp') }}  <!-- avoid the reserved _DBT prefix -->","handlingStrategy":"validation","validationCode":"// Reject reserved prefix before rendering\nfn is_reserved(name: &str) -> bool { name.starts_with(\"_DBT\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not create or depend on environment variables starting with _DBT","Use documented public context members (flags, invocation_id) instead of internal vars","Audit exported env vars in CI for the reserved _DBT prefix"],"tags":["jinja","env-var","reserved-names","dbt"],"backgroundTag":"missing-env-var","analyzedSha":"0267ce9170576975b76b64ce856b2e5848e96617","analyzedAt":"2026-09-07T21:53:39.732Z","contentChangedAt":"2026-09-07T21:53:39.732Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}