We noticed that your build.rs saves all environment variables. Some of which may be sensitive. The output of build.rs is saved in the target directory. If someone uses your project as a dependency and reuses the cash between environment that has access to sensitive variables and in environment controlled by users, your build.rs can be used to exfiltrate those secrets. We came across this while investigating a similar issue in MIRI https://blog.rust-lang.org/2026/09/21/github-actions-leaking-secrets-when-miri-output-is-cached/ Before we made the blog post about MIRI, The Rust Security Response Group scanned all crates for related patterns. I am starting to reach out to the projects found by that scan.

If this is not a problem relevant to your users, then I'm sorry for the noise, please feel free to close. Just wanted to make sure you are aware of this situation.