usebruno/bruno · error · Error

Invalid .env filename

Error message

Invalid .env filename

What it means

`isValidDotEnvFilename` requires basename === filename (no path separators) and a match of `.env` or `.env.<letters/digits/._->`. Anything else - a subdirectory, a non-.env name like `secret.txt`, or undefined - is rejected to prevent path traversal and arbitrary file writes.

Source

Thrown at packages/bruno-electron/src/ipc/global-environments.js:171

      return {
        globalEnvironments,
        activeGlobalEnvironmentUid
      };
    } catch (error) {
      console.error('Error in renderer:get-global-environments:', error);
      return Promise.reject(error);
    }
  });

  // Save workspace .env file variables
  ipcMain.handle('renderer:save-workspace-dotenv-variables', async (event, { workspacePath, variables, filename = '.env' }) => {
    try {
      if (!workspacePath) {
        throw new Error('Workspace path is required');
      }

      if (!isValidDotEnvFilename(filename)) {
        throw new Error('Invalid .env filename');
      }

      const dotEnvPath = path.join(workspacePath, filename);
      const content = jsonToDotenv(variables);
      await writeFile(dotEnvPath, content);

      return { success: true };
    } catch (error) {
      console.error('Error saving workspace .env file:', error);
      return Promise.reject(error);
    }
  });

  // Save workspace .env file raw content
  ipcMain.handle('renderer:save-workspace-dotenv-raw', async (event, { workspacePath, content, filename = '.env' }) => {
    try {
      if (!workspacePath) {
        throw new Error('Workspace path is required');

View on GitHub (pinned to 9bdd81c7bd)

Solutions

1. Omit `filename` to use the default `.env`.
2. Pass only the basename: `.env`, `.env.staging`, `.env.local`.
3. Never include directory separators in the filename argument.

Example fix

// before
invoke('renderer:save-workspace-dotenv-variables', { workspacePath, variables, filename: 'config/.env' });
// after
invoke('renderer:save-workspace-dotenv-variables', { workspacePath, variables, filename: '.env' });

const path = require('path');
const validEnvName = (f) => typeof f === 'string' && path.basename(f) === f && /^\.env(\.[a-zA-Z0-9._-]+)?$/.test(f);

const isDotEnvFilename = (f) => typeof f === 'string' && path.basename(f) === f && /^\.env(\.[a-zA-Z0-9._-]+)?$/.test(f);

When it happens

Trigger: Passing `filename: 'environments/.env'` (basename !== filename), `filename: 'foo.env'` (doesn't start with `.env`), `filename: '../../etc/passwd'`, or undefined.

Common situations: UI defaulting the filename wrongly; user typing a custom name; passing the full path instead of just the basename.

Related errors

• Invalid .env filename
• Invalid file name
• Workspace path is required
• Mock server id is required.
• Workspace path is required.

AI-assisted analysis of usebruno/bruno@9bdd81c7bd (2026-08-13). Data as JSON: /api/errors/81c9a0892368577d. Report an issue: GitHub.