docs: correct env var redaction setting keys

[harshil-mistry]

Summary

The environment variable redaction section of docs/reference/configuration.md documented two setting keys that don't exist, and omitted the one that actually turns the feature on. This corrects the section to match the schema and the code.

Details

The section told readers to configure redaction with security.allowedEnvironmentVariables and security.blockedEnvironmentVariables. Neither key exists anywhere in schemas/settings.schema.json, and since security is declared "additionalProperties": false, the documented JSON example is schema-invalid — an editor using the published schema flags it as an error.

The real settings sit one level deeper. packages/cli/src/config/config.ts reads settings.security?.environmentVariableRedaction?.blocked, ...?.allowed and ...?.enabled, and the schema defines exactly those three under security.environmentVariableRedaction. The same documentation page already lists them correctly in the settings reference further up, so the page was contradicting itself.

I also added enabled to the section. It defaults to false (packages/core/src/config/config.ts: params.enableEnvironmentVariableRedaction ?? false), but the section describes the redaction rules at length without mentioning that any of it requires opting in. Since this is a security feature, the failure mode is quiet and bad: you add the documented keys, nothing reads them, the feature is off anyway, and you believe your secrets are being redacted.

The example now uses the nested shape with enabled: true, so copying it produces working config rather than ignored config.

Related Issues

Fixes #29007

How to Validate

This is docs-only, so I verified against the schema and the code rather than at runtime:

1. Confirm the old keys don't exist — grep -c "allowedEnvironmentVariables\|blockedEnvironmentVariables" schemas/settings.schema.json returns 0.
2. Confirm the new keys do — the schema defines security.environmentVariableRedaction with exactly allowed, blocked and enabled (itself additionalProperties: false).
3. Validate both examples against the schema's security properties: the old example's two keys are both unknown (so invalid under additionalProperties: false), the new example's single environmentVariableRedaction key is known. I checked this by loading settings.schema.json and diffing each example's keys against properties.security.properties.
4. Confirm the default — packages/core/src/config/config.ts sets this.enableEnvironmentVariableRedaction = params.enableEnvironmentVariableRedaction ?? false, and the schema's enabled default is false.
5. Cross-check against the settings list in the same file (the security.environmentVariableRedaction.* entries), which the section now agrees with.

A reviewer can confirm quickly by putting the old example in a settings.json with $schema set and watching the editor flag both keys.

Pre-Merge Checklist

• Updated relevant documentation and README (if needed)
• Added/updated tests (if needed) — n/a, no code changed
• Noted breaking changes (if any) — none; this documents existing behavior
• Validated on required platforms/methods:
  • MacOS
    • npm run
    • npx
    • Docker
    • Podman
    • Seatbelt
  • Windows
    • npm run
    • npx
    • Docker
  • Linux

I left the platform matrix unchecked deliberately rather than ticking boxes I didn't exercise: this touches a single .md file with no code path, so there's nothing platform-specific to validate. I also didn't run npm run preflight for the same reason — happy to if you'd like it on the record.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses inaccuracies in the environment variable redaction documentation. The previous documentation referenced non-existent configuration keys that were incompatible with the project's JSON schema. By updating the documentation to reflect the correct nested structure and including the necessary 'enabled' flag, this change ensures that users can correctly configure and activate the security feature.

Highlights

• Documentation Correction: Updated the environment variable redaction documentation to use the correct configuration keys, aligning with the existing schema and codebase.
• Configuration Clarity: Added the 'enabled' flag to the documentation to clarify that the redaction feature must be explicitly turned on, preventing users from assuming it is active by default.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[github-actions]

📊 PR Size: size/S

• Lines changed: 18
• Additions: +12
• Deletions: -6
• Files changed: 1

[gemini-code-assist]

Code Review

This pull request updates the configuration documentation in docs/reference/configuration.md to reflect changes in how environment variable redaction is configured. Specifically, the flat security.allowedEnvironmentVariables and security.blockedEnvironmentVariables settings have been replaced with a nested security.environmentVariableRedaction object containing enabled, allowed, and blocked properties. The JSON configuration example has also been updated to match this new structure. There are no review comments, and I have no feedback to provide.

_{Note: Security Review has been skipped due to the limited scope of the PR.}

[harshil-mistry]

@googlebot I signed it!