This is a frequently asked question, and we have an answer.

The suggestion of checking in `.envrc` is not complete without giving
users the possibility to add their own statements.

This `.envrc-local` will not be taken into account by `direnv`’s
“security framework” however.

Co-authored-by: Judson <[email protected]>

Follow our own advice and make it possible for users to source their
own envrc additions if they need them.

Leo writes:

> I would simply never publicly claim that something is secure without
> qualification if there hasn't at least been a third-party audit. It
> just too strong a claim to make without concrete, specific evidence
> that someone with relevant training has tried to circumvent the
> security measures you've put in place and did not succeed.

> My suggestion would simply be to remove ", so from a security
> standpoint it is safe". The relevant bit for users is "will never
> run anything else than what is required".