From cc0fcb540057eb62fec5f0a26b7d2d0e8d51fbce Mon Sep 17 00:00:00 2001
From: gonzaloriestra <14979109+gonzaloriestra@users.noreply.github.com>
Date: Tue, 2 Jun 2026 00:40:05 +0000
Subject: [PATCH] [Security] Redact secrets in app env pull output

This change ensures that sensitive environment variables, specifically `SHOPIFY_API_SECRET`, are redacted with `****` in the console output and diffs generated by the `app env pull` command.

The unredacted secrets are still correctly written to the `.env` file on disk, but they are masked in terminal logs and history to prevent accidental exposure.

Changes:
- In `packages/app/src/cli/services/app/env/pull.ts`, created `redactedValues` and used `patchEnvFile` to generate redacted content for display.
- Updated `packages/app/src/cli/services/app/env/pull.test.ts` to verify redaction in console snapshots while ensuring file content remains complete.
---
 packages/app/src/cli/services/app/env/pull.test.ts |  7 +++----
 packages/app/src/cli/services/app/env/pull.ts      | 14 +++++++++++---
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/packages/app/src/cli/services/app/env/pull.test.ts b/packages/app/src/cli/services/app/env/pull.test.ts
index c8fd46e2488..d8d7a1033ad 100644
--- a/packages/app/src/cli/services/app/env/pull.test.ts
+++ b/packages/app/src/cli/services/app/env/pull.test.ts
@@ -40,7 +40,7 @@ describe('env pull', () => {
       "Created ${filePath}:
 
       SHOPIFY_API_KEY=api-key
-      SHOPIFY_API_SECRET=api-secret
+      SHOPIFY_API_SECRET=****
       SCOPES=my-scope
       "
       `)
@@ -66,15 +66,14 @@ describe('env pull', () => {
       "Updated ${filePath} to be:
 
       SHOPIFY_API_KEY=api-key
-      SHOPIFY_API_SECRET=api-secret
+      SHOPIFY_API_SECRET=****
       SCOPES=my-scope
 
       Here's what changed:
 
       - SHOPIFY_API_KEY=ABC
-      - SHOPIFY_API_SECRET=XYZ
       + SHOPIFY_API_KEY=api-key
-      + SHOPIFY_API_SECRET=api-secret
+      SHOPIFY_API_SECRET=****
       SCOPES=my-scope
         "
       `)
diff --git a/packages/app/src/cli/services/app/env/pull.ts b/packages/app/src/cli/services/app/env/pull.ts
index 422749dd02e..9d9a7992dfc 100644
--- a/packages/app/src/cli/services/app/env/pull.ts
+++ b/packages/app/src/cli/services/app/env/pull.ts
@@ -24,6 +24,11 @@ export async function pullEnv({app, remoteApp, organization, envFile}: PullEnvOp
     SCOPES: getAppScopes(app.configuration),
   }
 
+  const redactedValues = {
+    ...updatedValues,
+    SHOPIFY_API_SECRET: '****',
+  }
+
   if (await fileExists(envFile)) {
     const envFileContent = await readFile(envFile)
     const updatedEnvFileContent = patchEnvFile(envFileContent, updatedValues)
@@ -33,10 +38,12 @@ export async function pullEnv({app, remoteApp, organization, envFile}: PullEnvOp
     } else {
       await writeFile(envFile, updatedEnvFileContent)
 
-      const diff = diffLines(envFileContent ?? '', updatedEnvFileContent)
+      const redactedOldEnvFileContent = patchEnvFile(envFileContent, {SHOPIFY_API_SECRET: '****'})
+      const redactedEnvFileContent = patchEnvFile(envFileContent, redactedValues)
+      const diff = diffLines(redactedOldEnvFileContent, redactedEnvFileContent)
       return outputContent`Updated ${outputToken.path(envFile)} to be:
 
-${updatedEnvFileContent}
+${redactedEnvFileContent}
 
 Here's what changed:
 
@@ -45,12 +52,13 @@ ${outputToken.linesDiff(diff)}
     }
   } else {
     const newEnvFileContent = patchEnvFile(null, updatedValues)
+    const redactedEnvFileContent = patchEnvFile(null, redactedValues)
 
     await writeFile(envFile, newEnvFileContent)
 
     return outputContent`Created ${outputToken.path(envFile)}:
 
-${newEnvFileContent}
+${redactedEnvFileContent}
 `
   }
 }