Channels Overview

A channel represents an outbound boundary through which sensitive data can leave your application. envtrap monitors five distinct runtime channels.

The 5 Monitored Channels

Network (network)

Intercepts outbound HTTP/HTTPS traffic through an in-memory loopback MITM proxy.

DNS Resolution (dns)

Intercepts core node:dns lookup and resolution APIs to block secret queries and tunneling.

Subprocess Spawning (child_process)

Wraps spawn, exec, and fork to prevent passing credentials via options.env.

Terminal Output (stdout & stderr)

Scans and redacts credentials from stdout and stderr console streams in real time.

Enforcement Modes

Each channel can be independently configured in envtrap.json with one of three modes:

Mode	Action on Detection	Process State	Output / Redaction
`block`	The operation is actively prevented	Throws Error or terminates process	Socket destroyed / Process killed
`warn`	Alert is logged and reported	Execution continues	`[REDACTED: SHA256:...]`
`off`	Channel inspection is disabled	Unmonitored	Unchanged

Default Policies

envtrap ships with zero-configuration defaults designed to stop remote exfiltration while maintaining developer visibility:

envtrap.json

{
  "channels": {
    "network":       "block",
    "dns":           "block",
    "child_process": "warn",
    "stdout":        "warn",
    "stderr":        "warn"
  }
}

Getting Started

Core Architecture

Monitoring Channels

Configuration

Threat Model & Security

CLI Reference

Releases

Contributing

Channels Overview

Channels Overview

The 5 Monitored Channels

Network (network)

DNS Resolution (dns)

Subprocess Spawning (child_process)

Terminal Output (stdout & stderr)

Enforcement Modes

Default Policies

​Channels Overview

​The 5 Monitored Channels

Network (network)

DNS Resolution (dns)

Subprocess Spawning (child_process)

Terminal Output (stdout & stderr)

​Enforcement Modes

​Default Policies

Channels Overview

The 5 Monitored Channels

Enforcement Modes

Default Policies