Protect CMS deploy password field

server/admin-server.mjs

@@ -215,6 +215,11 @@ function trailingSlashUrl(value) {
   return trimmed.endsWith("/") ? trimmed : `${trimmed}/`;
 }
 
+function normalizeSecretEnvName(value, fallback = "MCHOST_PASSWORD") {
+  const trimmed = String(value || "").trim();
+  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(trimmed) ? trimmed : fallback;
+}
+
 function fileReady(filePath) {
   try {
     return statSync(filePath).isFile();
@@ -809,8 +814,14 @@ function authorizeRequest(req, res, url) {
 }
 
 function publicProjectConfig() {
+  const deploy = {
+    ...(projectConfig.deploy || {}),
+    passwordEnv: normalizeSecretEnvName(projectConfig.deploy?.passwordEnv),
+  };
+
   return {
     ...projectConfig,
+    deploy,
     id: projectConfig.id || activeProjectId,
     runtime: {
       cmsRoot,
@@ -829,7 +840,7 @@ function normalizeProjectConfig(payload) {
     host: String(payload?.deploy?.host || "").trim(),
     port: Number(payload?.deploy?.port || (payload?.deploy?.method === "ftp" ? 21 : 22)),
     username: String(payload?.deploy?.username || "").trim(),
-    passwordEnv: String(payload?.deploy?.passwordEnv || "").trim(),
+    passwordEnv: normalizeSecretEnvName(payload?.deploy?.passwordEnv),
     remotePath: String(payload?.deploy?.remotePath || "").trim(),
     deployOnRender: Boolean(payload?.deploy?.deployOnRender),
   };