@Sylvhem exactly: completely different issue, same result. master exposed env vars through a file, i exposed it through an unprotected API.