{"id":"adf787f3256a2df1","repo":"vitejs/vite","slug":"envprefix-option-contains-value-which-could-le","errorCode":null,"errorMessage":"envPrefix option contains value '', which could lead unexpected exposure of sensitive information.","messagePattern":"envPrefix option contains value '', which could lead unexpected exposure of sensitive information\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/vite/src/node/env.ts","lineNumber":114,"sourceCode":"  // check if there are actual env variables starting with VITE_*\n  // these are typically provided inline and should be prioritized\n  for (const key in process.env) {\n    if (prefixes.some((prefix) => key.startsWith(prefix))) {\n      env[key] = process.env[key]!\n    }\n  }\n\n  debug?.(`using resolved env: %O`, env)\n\n  return env\n}\n\nexport function resolveEnvPrefix({\n  envPrefix = 'VITE_',\n}: UserConfig): string[] {\n  envPrefix = arraify(envPrefix)\n  if (envPrefix.includes('')) {\n    throw new Error(\n      `envPrefix option contains value '', which could lead unexpected exposure of sensitive information.`,\n    )\n  }\n  if (envPrefix.some((prefix) => /\\s/.test(prefix))) {\n    // eslint-disable-next-line no-console\n    console.warn(\n      colors.yellow(\n        `[vite] Warning: envPrefix option contains values with whitespace, which does not work in practice.`,\n      ),\n    )\n  }\n  return envPrefix\n}\n","sourceCodeStart":96,"sourceCodeEnd":128,"githubUrl":"https://github.com/vitejs/vite/blob/89620f09afcfef6b35e7bb8660132ab5b4d0cd3b/packages/vite/src/node/env.ts#L96-L128","documentation":"`resolveEnvPrefix` throws when `envPrefix` contains an empty string because an empty prefix matches every key, which would expose the entire `process.env` (DATABASE_URL, tokens, private keys) to client-bundle code. Vite only ships prefixed vars to the client precisely to keep secrets server-side, so the empty-prefix case is treated as a configuration defect. The check lives at env.ts:113.","triggerScenarios":"Setting `envPrefix: ''`, `envPrefix: ['']`, `envPrefix: ['VITE_', '']`, or passing an array/string that resolves to an empty element in the Vite config.","commonSituations":"Wanting to expose all env vars without picking a prefix; copy-pasting `envPrefix: process.env.VITE_PREFIX ?? ''`; arrays built dynamically where one branch yields `''`.","solutions":["Use a concrete prefix such as `envPrefix: 'VITE_'` (default) or a custom one like `'APP_'`.","If you need multiple prefixes, list non-empty ones: `envPrefix: ['VITE_', 'APP_']`.","Remove any code path that can produce `''` in the prefix array (guard with a fallback)."],"exampleFix":"// before\nexport default defineConfig({ envPrefix: '' })\n\n// after\nexport default defineConfig({ envPrefix: 'VITE_' })","handlingStrategy":"validation","validationCode":"function assertEnvPrefix(prefix: string | string[]) {\n  const arr = Array.isArray(prefix) ? prefix : [prefix]\n  if (arr.includes('')) throw new Error('envPrefix must not contain an empty string (exposes all env vars)')\n}","typeGuard":"function isSafeEnvPrefix(prefix: unknown): prefix is string | string[] {\n  const arr = Array.isArray(prefix) ? prefix : [prefix]\n  return arr.every((p) => typeof p === 'string' && p.length > 0 && !/\\s/.test(p))\n}","tryCatchPattern":null,"preventionTips":["Always pass a non-empty prefix; default 'VITE_' is intentional for secret isolation.","When building a prefix array dynamically, filter out empty strings."],"tags":["env","config","security","validation"],"analyzedSha":"89620f09afcfef6b35e7bb8660132ab5b4d0cd3b","analyzedAt":"2026-08-03T19:28:02.920Z","schemaVersion":2}