# ENV KEYS NO TEST CREDENTIAL FILE MAY SET — one shell-glob pattern per line; the ONE list read by sandbox_exec.sh
# (bash `case`-style match) and suite_needs.py (fnmatch). A HARD FLOOR under the per-repo allow-list: the allow-list is
# derived from what failing tests reached for, so its key names can be influenced by the code under test, and these
# keys change what RUNS or whom the granted NETWORK trusts. Lower-case forms are already refused by the key syntax.
# what runs / how
PATH
HOME
TMPDIR
LANG
TZ
SHELL
ENV
IFS
LD_*
BASH_*
PYTHON*
PYTEST_*
NODE_OPTIONS
JAVA_TOOL_OPTIONS
_JAVA_OPTIONS
GIT_*
PERL5OPT
PERL5LIB
RUBYOPT
RUBYLIB
GOFLAGS
PIP_*
UV_*
# whom the granted network trusts
HTTP_PROXY
HTTPS_PROXY
ALL_PROXY
NO_PROXY
FTP_PROXY
SSL_CERT_FILE
SSL_CERT_DIR
REQUESTS_CA_BUNDLE
CURL_CA_BUNDLE
NODE_EXTRA_CA_CERTS
