[groupsky]

What

In nodkey run --secret VAR=NAME, the variable name decides what the command does with the value. Some names make common programs print, store or run the value: ld.so prints a bad LD_PRELOAD, the JVM prints JAVA_TOOL_OPTIONS, a p in MAKEFLAGS makes make print every variable, GOFLAGS makes go print the value, NPM_CONFIG_SCRIPT_SHELL is run by npm run, and so on.

• A shared deny list (api.DeniedVar, 119 names and 7 prefixes: LD_, DYLD_, GCONV_, LC_, RESOLV_, GIT_, NPM_CONFIG_).
• The broker refuses such a name before anything else: no message, grant, "never ask" rule, queue place or fetch. It answers 403 and writes request and denied:not_allowed; a rate-limited log line names only the matched rule.
• nodkey run refuses it first, with a usage error (exit 64), before it asks anyone.
• Real secret names stay allowed on purpose, for example GH_TOKEN, DOCKER_PASSWORD, NPM_TOKEN, GOPROXY, HTTPS_PROXY, LDAP_PASSWORD (LDAP_ is not LD_).
• Each name has a one-line reason in DESIGN.md section 5; most were checked on a real machine with a made-up value. A test keeps the code and the table in step.

Docs

DESIGN.md sections 5 and 10; THREAT-MODEL.md T15 and T28; the security-reviewer checklist mentions the deny list.

Review

Three rounds with the security-reviewer agent; the last said "ready to commit" after MANPAGER was added. The check runs before anything else, cannot be bypassed, and leaks no value.

Left for later issues: #65 (allow lower-case letters in variable names, for Terraform's TF_VAR_* and TF_TOKEN_*).

Closes #57