Repository: Infisical/infisical
File: backend/src/lib/config/env.ts (TypeScript)

Code before:
    OTEL_OTLP_PUSH_INTERVAL: z.coerce.number().default(30000),
    OTEL_COLLECTOR_BASIC_AUTH_USERNAME: zpStr(z.string().optional()),
    OTEL_COLLECTOR_BASIC_AUTH_PASSWORD: zpStr(z.string().optional()),
    OTEL_EXPORT_TYPE: z.enum(["prometheus", "otlp"]).optional(),

    PYLON_API_KEY: zpStr(z.string().optional()),
    DISABLE_AUDIT_LOG_GENERATION: zodStrBool.default("false"),
    SSL_CLIENT_CERTIFICATE_HEADER_KEY: zpStr(z.string().optional()).default("x-ssl-client-cert"),
    IDENTITY_TLS_CERT_AUTH_CLIENT_CERTIFICATE_HEADER_KEY: zpStr(z.string().optional()).default(
      "x-identity-tls-cert-auth-client-cert"
    ),
    WORKFLOW_SLACK_CLIENT_ID: zpStr(z.string().optional()),
    WORKFLOW_SLACK_CLIENT_SECRET: zpStr(z.string().optional()),
    ENABLE_MSSQL_SECRET_ROTATION_ENCRYPT: zodStrBool.default("true"),

    // Special Detection Feature
    PARAMS_FOLDER_SECRET_DETECTION_PATHS: zpStr(
      z
        .string()
        .optional()
        .transform((val) => {
          if (!val) return undefined;
          return JSON.parse(val) as { secretPath: string; projectId: string }[];
        })
    ),

    // HSM
    HSM_LIB_PATH: zpStr(z.string().optional()),
    HSM_PIN: zpStr(z.string().optional()),
    HSM_KEY_LABEL: zpStr(z.string().optional()),
    HSM_SLOT: z.coerce.number().optional().default(0),

    USE_PG_QUEUE: zodStrBool.default("false"),
    SHOULD_INIT_PG_QUEUE: zodStrBool.default("false"),

    /* Gateway----------------------------------------------------------------------------- */
    GATEWAY_INFISICAL_STATIC_IP_ADDRESS: zpStr(z.string().optional()),
    GATEWAY_RELAY_ADDRESS: zpStr(z.string().optional()),
    GATEWAY_RELAY_REALM: zpStr(z.string().optional()),
    GATEWAY_RELAY_AUTH_SECRET: zpStr(z.string().optional()),

    DYNAMIC_SECRET_ALLOW_INTERNAL_IP: zodStrBool.default("false"),
    DYNAMIC_SECRET_AWS_ACCESS_KEY_ID: zpStr(z.string().optional()).default(
      process.env.INF_APP_CONNECTION_AWS_ACCESS_KEY_ID
    ),
    DYNAMIC_SECRET_AWS_SECRET_ACCESS_KEY: zpStr(z.string().optional()).default(
      process.env.INF_APP_CONNECTION_AWS_SECRET_ACCESS_KEY
    ),
    /* ----------------------------------------------------------------------------- */

    /* App Connections ----------------------------------------------------------------------------- */

Review comment (suggestion):
Maybe we can lower this to 3.7 so we can catch a few more cases, tested it with a few examples from here `https://github.com/gitleaks/gitleaks/blob/master/detect/detect_test.go` and have a 3.7/4 entropy in most cases

Code after:
    OTEL_OTLP_PUSH_INTERVAL: z.coerce.number().default(30000),
    OTEL_COLLECTOR_BASIC_AUTH_USERNAME: zpStr(z.string().optional()),
    OTEL_COLLECTOR_BASIC_AUTH_PASSWORD: zpStr(z.string().optional()),
    OTEL_EXPORT_TYPE: z.enum(["prometheus", "otlp"]).optional(),

    PYLON_API_KEY: zpStr(z.string().optional()),
    DISABLE_AUDIT_LOG_GENERATION: zodStrBool.default("false"),
    SSL_CLIENT_CERTIFICATE_HEADER_KEY: zpStr(z.string().optional()).default("x-ssl-client-cert"),
    IDENTITY_TLS_CERT_AUTH_CLIENT_CERTIFICATE_HEADER_KEY: zpStr(z.string().optional()).default(
      "x-identity-tls-cert-auth-client-cert"
    ),
    WORKFLOW_SLACK_CLIENT_ID: zpStr(z.string().optional()),
    WORKFLOW_SLACK_CLIENT_SECRET: zpStr(z.string().optional()),
    ENABLE_MSSQL_SECRET_ROTATION_ENCRYPT: zodStrBool.default("true"),

    // Special Detection Feature
    PARAMS_FOLDER_SECRET_DETECTION_PATHS: zpStr(
      z
        .string()
        .optional()
        .transform((val) => {
          if (!val) return undefined;
          return JSON.parse(val) as { secretPath: string; projectId: string }[];
        })
    ),
    PARAMS_FOLDER_SECRET_DETECTION_ENTROPY: z.coerce.number().optional().default(4.5),

    // HSM
    HSM_LIB_PATH: zpStr(z.string().optional()),
    HSM_PIN: zpStr(z.string().optional()),
    HSM_KEY_LABEL: zpStr(z.string().optional()),
    HSM_SLOT: z.coerce.number().optional().default(0),

    USE_PG_QUEUE: zodStrBool.default("false"),
    SHOULD_INIT_PG_QUEUE: zodStrBool.default("false"),

    /* Gateway----------------------------------------------------------------------------- */
    GATEWAY_INFISICAL_STATIC_IP_ADDRESS: zpStr(z.string().optional()),
    GATEWAY_RELAY_ADDRESS: zpStr(z.string().optional()),
    GATEWAY_RELAY_REALM: zpStr(z.string().optional()),
    GATEWAY_RELAY_AUTH_SECRET: zpStr(z.string().optional()),

    DYNAMIC_SECRET_ALLOW_INTERNAL_IP: zodStrBool.default("false"),
    DYNAMIC_SECRET_AWS_ACCESS_KEY_ID: zpStr(z.string().optional()).default(
      process.env.INF_APP_CONNECTION_AWS_ACCESS_KEY_ID
    ),
    DYNAMIC_SECRET_AWS_SECRET_ACCESS_KEY: zpStr(z.string().optional()).default(
      process.env.INF_APP_CONNECTION_AWS_SECRET_ACCESS_KEY
    ),
    /* ----------------------------------------------------------------------------- */