Summary

host_env_read (the WASM host function backing EnvRead) suppresses secret-looking environment variables before handing them to a guest, so that a plugin granted EnvRead("*") cannot read ANTHROPIC_API_KEY, MY_TOKEN, etc.
The match is a both-sides word-boundary check, deliberately tightened (over a plain contains) so benign config like MONKEYHOUSE, KEYBOARD_LAYOUT, TOKENIZER_OPTS stays readable.

The gap: a separator-less secret name glues the credential word to the end with no boundary — APIKEY, MYTOKEN, DBPASSWORD, GHTOKEN, STRIPEKEY, ALGOLIA_APIKEY.
For APIKEY, KEY starts at index 3 with the preceding byte I (alphanumeric), so the both-sides rule rejects the match and the variable is not blocked — host_env_read then returns the real secret to the guest.
This is a defense-in-depth bypass for any plugin holding a wildcard EnvRead capability.

Changes

• crates/librefang-runtime/src/host_functions.rs — is_blocked_env_var now matches upper.ends_with(sub) || has_word_boundary_substring(&upper, sub).
  The suffix arm catches the separator-less names; the existing both-sides arm is unchanged.
• A starts_with arm is intentionally omitted: it would re-flag TOKENIZER_OPTS / PRIVATELABEL_NAME / PASSWORDLIST_FILE, the exact benign-config false positives the both-sides rule was written to allow.
• Trade-off documented in code: the suffix rule over-blocks a benign name ending in a secret word (TURKEY, MONKEY), which is the safe direction — the guest gets null, never a credential.

Verification

• cargo clippy -p librefang-runtime --lib -- -D warnings — passed, zero warnings.
• cargo test -p librefang-runtime --lib is_blocked_env_var — 2 passed, 0 failed. The extended test_is_blocked_env_var_word_boundary now asserts APIKEY / MYTOKEN / DBPASSWORD / GHTOKEN / STRIPEKEY / ALGOLIA_APIKEY are blocked, while the existing benign negatives (MONKEYHOUSE, KEYBOARD_LAYOUT, TOKENIZER_OPTS, PRIVATELABEL_NAME, PASSWORDLIST_FILE, MASTERKEYBOARD) still pass.
• cargo fmt -p librefang-runtime --check — clean.

(Run in the repo's Dockerfile.rust-dev image against an isolated target volume, per the project's no-local-cargo rule.)

Context

Surfaced by a repo-wide security audit. Filed as its own PR (one of several from that pass); it is self-contained in the WASM-sandbox host-function layer and unrelated to the other findings.