I'm open to adding a info block warning against doing something like 'process.env': env, but otherwise this isn't a security issue. It has been discussed at #16686. We shouldn't avoid passing '' in the docs.

@bluwy,

I never said that what is in the current documentation is a security issue, only that it could become one if developers copy the code snippet and return the variable that is defined !
I think it's less risky and just as valid to pass an array of prefixes as the third argument. It doesn't change anything else; the comment in the code still explains that it's possible to use '' instead :)

I also add that it's never a good practice to retrieve all environment variables into a single variable.

@sapphi-red While I believe this is a step in the right direction but I do believe that changing the doc would be more beneficial, even with a warning some people will still ignore it or don't read it. The best way to save those people is to not have a problematic code that they can copy and paste.

I believe that @qu35t-code suggestion provides a safer snippet that will not be problematic for users that don't read the documentation or the warning and would sill allow conscious developer to achieve what they want if required.
#19517 (comment)

I don't think the current code is problematic. The problem is that people are passing sensitive values to define. Even if we removed '', I assume people would merge the values with process.env.

The reason why this section exists is to tell users how to use arbitrary env vars (including values from .env files). If they only need env vars limited to a specific prefix, they won't need to use any of this code. It'll be available automatically. If we remove '', then this whole section doesn't make sense.