fix: do not log raw json value in json validator error

src/validators.ts

@@ -112,7 +112,8 @@ export const url = makeValidator<string>((x: string) => {
 export const json = makeStructuredValidator((x: string) => {
   try {
     return JSON.parse(x)
-  } catch (e) {
-    throw new EnvError(`Invalid json: "${x}"`)
+  } catch {
+    // Not logging the json value as it could contain sensitive data
+    throw new EnvError(`Invalid json`)
   }
 })

tests/validators.test.ts

@@ -123,6 +123,16 @@ test('json()', () => {
 
   expect(() => cleanEnv({ FOO: 'abc' }, { FOO: json() }, makeSilent)).toThrow()
 
+  // The error message should not include the raw value, as it could contain sensitive data
+  let thrownError: unknown
+  try {
+    cleanEnv({ FOO: '{"password": "hunter2"' }, { FOO: json() }, makeSilent)
+  } catch (e) {
+    thrownError = e
+  }
+  expect((thrownError as Error).message).toBe('Invalid json')
+  expect((thrownError as Error).message).not.toContain('hunter2')
+
   // default value should be passed through without running through JSON.parse()
   expect(
     cleanEnv(