#523 prevent access to config/env