Laravel Lumen .env variable values are showing when I dump Request

Question

I'm noticing when I dd($request) from the Illuminate\Http\Request, I see all of my .env variables and values. This is a security risk that I'm not aware how to hide. How would I store these values in .env but not make them publicly assessable like this?

Answer 1

As mentioned in comment, you should not use dd() nor dump() in production.

If you are concerned about seeing env variables being displayed in your application, you can either

1. set APP_DEBUG=false in your .env file

2. set the 'debug_blacklist' key in your app\config file to hide some specific keys from the Whoops page (As seen on https://stackoverflow.com/a/46407010/4258328 )