Hide .env sensitive information in Laravel whoops output.

Tilak poudel
2 min readJul 18, 2020

As we all know that .env file contain the sensitive information of the app, so it is necessary to protect them from being exposed. so today i am here to tell you .

It is very important to secure the sensitive information like APP_KEY, `DB_USERNAME`, `DB_PASSWORD`, even MAIL_USERNAME ,MAIL_PASSWORD and many other sensitive information that may be exposed if we don’t take care .

We can hide our information , ok lets see how to protect it.

We can censor variable in the .env file by listing them under the key debug_blacklist in config/app.php .

When exception is thrown, whoops will mask these values with asteriks * for each character.

For instance , add the variables you want to hide under debug_blacklist.

we can do this for _env and _server .

code to be added in config/app.php file.

By doing this we can mask the sensitive information with the * sign .

If you want to mask all the variables then you can simply do this:

Hurray we are done .

Thanks , let me know in comment section is it helpful or not.

--

--