Documentation

Environment variables¶

This page is generated from the code that reads each variable by scripts/generate_env_var_reference.py. Edits made to this file by hand are overwritten the next time it is generated.

ASH reads 141 environment variables: 58 of its own (ASH_ prefix) and 83 set by other tools or the platform. The tables list every place each one is read. A variable that sets a CLI option links to that option; the option on the command line takes precedence over the variable.

Columns:

Default: the value the code uses when the variable is unset, as written in the code, at each read that supplies one. Where none does, or the only one is an empty string, it is the default of the CLI option the variable sets, or of the configuration key it is the default of. Blank means none of these supplies one (the code checks whether the variable is set, or treats unset as empty).
Container image: the value the ASH container image sets, from an ENV line in the Dockerfile, and the build stage that sets it.
Read at: the file of each read and the function, method or script function it is in, or module level or top level when it is in none. ash and utils/ are the shell and PowerShell entry scripts; everything else is the Python package.
Purpose: the option's help text, or the code comment or docstring at the read, quoted with the file and function it is in. "Purpose not documented in code." means the code around the read does not say.

ASH variables¶

Variable	Default	Container image	Read at	Purpose
`ASH_ACTUAL_OUTPUT_DIR`	`self._context.output_dir.as_posix()` `display_path(opts.output_dir)`		`automated_security_helper/core/execution_engine.py` (`ScanExecutionEngine.execute_phases`) `automated_security_helper/interactions/run_ash_scan.py` (`_print_summary`, `_print_workspace_summary`) `automated_security_helper/utils/scan_output_dirs.py` (`_host_output_dir_in_the_tree`)	The single-scan summary's rule (display_path): relative to the working directory, else absolute, and the host's path inside the container image. (`automated_security_helper/interactions/run_ash_scan.py`, `_print_workspace_summary`)
`ASH_ACTUAL_SOURCE_DIR`	`self._context.source_dir.as_posix()`		`automated_security_helper/core/execution_engine.py` (`ScanExecutionEngine.execute_phases`) `automated_security_helper/utils/scan_output_dirs.py` (`_host_output_dir_in_the_tree`) `automated_security_helper/utils/scan_source.py` (`_started_by_the_launcher`)	Set by ASH's container launcher (`run_ash_container`): the host's source and output directories, mounted at `/src` and `/out`. (`automated_security_helper/utils/scan_output_dirs.py`)
`ASH_ALLOW_IN_TREE_TOOLS`			`automated_security_helper/utils/subprocess_utils.py` (`in_tree_tools_allowed`)	The environment variable that lets ASH start a tool from inside the scanned tree. Read from the process environment only, which belongs to the operator. (`automated_security_helper/utils/subprocess_utils.py`)
`ASH_BASE_IMAGE_OVERRIDE`	`""`		`ash` (top level) `automated_security_helper/interactions/run_ash_container.py` (`_build_image`, `run_ash_container`) `utils/ash_helpers.ps1` (`Invoke-ASH`)	ASH_BASE_IMAGE_OVERRIDE redirects `FROM ${BASE_IMAGE}` at the registry that actually answered, and is set by .github/actions/prepull-base-image when ECR Public refuses the base image and Docker Hub serves it instead. (`automated_security_helper/interactions/run_ash_container.py`, `_build_image`)
`ASH_BASE_OCI_LAYOUT`	`""`		`ash` (top level) `automated_security_helper/interactions/run_ash_container.py` (`_base_oci_layout_args`) `utils/ash_helpers.ps1` (`Invoke-ASH`)	`ASH_BASE_OCI_LAYOUT=<layout dir>@<arch manifest digest>` is set by `.github/actions/prepull-base-image` on a cache hit, after it has verified every blob in the layout against the Dockerfile's pinned digest. (`automated_security_helper/interactions/run_ash_container.py`, `_base_oci_layout_args`)
`ASH_BASE_REF`	`origin/main`		`automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`)	Sets `ash scan --base-ref`. Git ref to diff against when --changed-files-only is set.
`ASH_BEDROCK_MAX_TOKENS`	`4000`		`automated_security_helper/plugin_modules/ash_aws_plugins/bedrock_summary_reporter.py` (`BedrockSummaryReporterConfigOptions`, `_read_ash_bedrock_defaults`)	Sets the default of `reporters.bedrock-summary-reporter.options.max_tokens`.
`ASH_BEDROCK_MODEL_ID`	`""` `us.anthropic.claude-3-7-sonnet-20250219-v1:0`		`automated_security_helper/config/ash_config.py` (`reporter_default_values`) `automated_security_helper/plugin_modules/ash_aws_plugins/bedrock_summary_reporter.py` (`BedrockSummaryReporterConfigOptions`, `_read_ash_bedrock_defaults`)	Sets the default of `reporters.bedrock-summary-reporter.options.model_id`.
`ASH_BEDROCK_TEMPERATURE`	`0.5`		`automated_security_helper/plugin_modules/ash_aws_plugins/bedrock_summary_reporter.py` (`BedrockSummaryReporterConfigOptions`, `_read_ash_bedrock_defaults`)	Sets the default of `reporters.bedrock-summary-reporter.options.temperature`.
`ASH_BIN_PATH`	`~/.ash/bin`	`${ASH_BIN_PATH}` (core)	`automated_security_helper/cli/dependencies.py` (`install_dependencies`) `automated_security_helper/core/constants.py` (`ash_bin_path_from_environment`) `automated_security_helper/utils/subprocess_utils.py` (`_lookup`) `automated_security_helper/utils/uv_tool_runner.py` (`_lookup_key`)	Sets `ash dependencies install --bin-path`. Path to install binaries to.
`ASH_CFN_GUARD_RULES_DIR`		`/usr/share/ash/cfn-guard-rules` (core)	`automated_security_helper/utils/rules_bundles.py` (`rules_root`)	Environment variable naming the directory rules bundles are installed under. (`automated_security_helper/utils/rules_bundles.py`)
`ASH_CHANGED_FILES_ONLY`	off		`automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`)	Sets `ash scan --changed-files-only`. Report only findings in files changed between --base-ref and HEAD, for example on a pull request. Scanners still scan every file; findings located in other files are dropped from every report, the summary counts and the exit code. Findings with no file location are kept. When git cannot list the changes, everything is reported; when nothing changed inside --source-dir, nothing is. Not supported with --mode container, which refuses it (exit 5).
`ASH_CLOUDWATCH_LOG_GROUP_NAME`	`null` (the default of `reporters.cloudwatch-logs.options.log_group_name`)		`automated_security_helper/config/ash_config.py` (`reporter_default_values`) `automated_security_helper/plugin_modules/ash_aws_plugins/cloudwatch_logs_reporter.py` (`CloudWatchLogsReporterConfigOptions`)	Sets the default of `reporters.cloudwatch-logs.options.log_group_name`.
`ASH_CONFIG`	not set		`ash` (top level) `automated_security_helper/cli/config.py` (`_refused_file_label`, `get`, `init`, `lint`, `update`, `validate`, `validate_plugin_dependencies`, `wizard`) `automated_security_helper/cli/dependencies.py` (`install_dependencies`) `automated_security_helper/cli/image.py` (`build_ash_image_cli_command`) `automated_security_helper/cli/inspect/inspect_findings_app.py` (`findings_command`) `automated_security_helper/cli/mcp/__init__.py` (`_ash_config_refusal`) `automated_security_helper/cli/merge.py` (`merge_command`) `automated_security_helper/cli/plugin.py` (`list_plugins`) `automated_security_helper/cli/report.py` (`report_command`) `automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`) `automated_security_helper/config/config_validator.py` (`ConfigValidator._ash_config_check`) `automated_security_helper/config/default_config.py` (`_ash_config_file`, `default_config_document`, `default_config_document_for_tree`, `get_default_config`) `automated_security_helper/config/named_config.py` (`refuse_a_named_config_that_does_not_exist`) `automated_security_helper/config/resolve_config.py` (`_resolve_config`, `resolve_config`) `automated_security_helper/interactions/run_ash_container.py` (`_host_ash_config`) `automated_security_helper/interactions/run_ash_scan.py` (`_ash_config_fallback`, `_gate_has_a_schema_to_judge`, `_outer_mode_config_load`, `_refuse_a_named_config_that_is_not_a_file`, `run_ash_scan`) `utils/ash_helpers.ps1` (`Invoke-ASH`)	Sets `ash build-image --config`. The path to the configuration file. By default, ASH looks for the following config file names in the source directory of a scan: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. Alternatively, the full path to a config file can be provided by setting the ASH_CONFIG environment variable before running ASH. Sets `ash config get --config`. The path to the configuration file. By default, the config a scan of the current directory would use: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. Sets `ash config init --config`. Where to write the new config file. By default .ashrc.yaml in the current directory, a name a scan of that directory reads. Discovery reads these names: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. Can also be set with the ASH_CONFIG environment variable. Sets `ash config lint --config`. The path to the configuration file. By default, the config a scan of the current directory would use: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. Sets `ash config update --config`. The path to the configuration file. By default, the config a scan of the current directory would use: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. Sets `ash config validate --config`. The path to the configuration file. By default, the config a scan of the current directory would use: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. Sets `ash config validate-plugin-dependencies --config`. The path to the configuration file. By default, the config a scan of the current directory would use: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. Sets `ash config wizard --config`. Path to read/write the configuration file. By default, the config a scan of the current directory would use, or a new .ashrc.yaml when there is none. Sets `ash dependencies install --config`. The path to the configuration file. By default, ASH looks for the following config file names in the source directory of a scan: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. Alternatively, the full path to a config file can be provided by setting the ASH_CONFIG environment variable before running ASH. Sets `ash inspect findings --config`. Path to the configuration file where suppressions should be saved. By default, ASH searches for ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. With none found, suppressions go to a new .ashrc.yaml in the current directory. Sets `ash merge --config`. The operator's config file. Its values replace the shards' for the settings a shard's recorded config cannot choose, such as where reporters send findings and which off-host reporters run. Its ash_plugin_modules are the plugin modules the merge loads, with any --config-overrides adds; a module only the shards recorded is not loaded. It adds no reporter section the shards did not record; use --config-overrides for that. Sets `ash plugin list --config`. The path to the configuration file. By default, ASH looks for the following config file names in the source directory of a scan: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. Alternatively, the full path to a config file can be provided by setting the ASH_CONFIG environment variable before running ASH. Sets `ash report --config`. The path to the configuration file. By default, ASH looks for the following config file names in the source directory of a scan: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. Alternatively, the full path to a config file can be provided by setting the ASH_CONFIG environment variable before running ASH. Sets `ash scan --config`. The path to the configuration file. By default, ASH looks for the following config file names in the source directory of a scan: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. Alternatively, the full path to a config file can be provided by setting the ASH_CONFIG environment variable before running ASH.
`ASH_DEBUG`	`""` `NO`		`automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`) `automated_security_helper/core/execution_engine.py` (`ScanExecutionEngine.__init__`) `automated_security_helper/interactions/run_ash_scan.py` (`_env_flag`) `utils/common.sh` (`debug_echo`, `debug_show_tree`)	Sets `ash scan --debug`. Enable debug logging. Any log flag on the command line overrides ASH_DEBUG.
`ASH_DEBUG_SHOW_LOCALS`	`NO`		`automated_security_helper/utils/log.py` (`_show_locals_requested`)	ASH_DEBUG_SHOW_LOCALS asks for them, for a maintainer debugging on their own machine. (`automated_security_helper/utils/log.py`, `show_debug_locals`)
`ASH_DEFAULT_SEVERITY_LEVEL`	`MEDIUM` (the default of `global_settings.severity_threshold`)		`automated_security_helper/core/constants.py` (module level)	Sets the default of `global_settings.severity_threshold`.
`ASH_DEPENDENCIES_UNKNOWN_TOOLS`	`""`		`automated_security_helper/cli/dependencies.py` (`install_dependencies`)	Exactly `skip`, as the docs say: not a value that only strips to it. (`automated_security_helper/cli/dependencies.py`, `install_dependencies`)
`ASH_DETECT_SECRETS_REFUSE_HTTP`			`automated_security_helper/utils/detect_secrets_worker.py` (module level)	Only as the worker itself (`python -m`) or as a spawned pool process, which imports the worker as `__mp_main__`. ASH imports this module for REFUSE_HTTP_ENV, and the variable must not turn off HTTP in ASH's own process. (`automated_security_helper/utils/detect_secrets_worker.py`)
`ASH_DISABLE_GHA_BUILD_CACHE`	`""`		`automated_security_helper/interactions/run_ash_container.py` (`_gha_layer_cache_args`)	Purpose not documented in code.
`ASH_DOWNLOAD_MAX_ATTEMPTS`			`automated_security_helper/utils/download_utils.py` (`_download_retry_policy`)	Purpose not documented in code.
`ASH_DOWNLOAD_RETRY_DELAY`			`automated_security_helper/utils/download_utils.py` (`_download_retry_policy`)	Purpose not documented in code.
`ASH_EXCLUDED_SCANNERS`	not set		`automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`)	Sets `ash scan --exclude-scanners`. Specific scanner names to exclude from running. Takes precedence over scanners parameter.
`ASH_GHA_BUILD_CACHE_EXPORT`	`""`		`automated_security_helper/interactions/run_ash_container.py` (`_gha_layer_cache_args`)	Which layers to export, if any: ASH_GHA_BUILD_CACHE_EXPORT is none, min or max, and unset means min. min stays the default. (`automated_security_helper/interactions/run_ash_container.py`, `_gha_layer_cache_args`)
`ASH_IMAGE_NAME`	`automated-security-helper:${TARGET_STAGE}`		`ash` (top level) `automated_security_helper/interactions/run_ash_container.py` (`run_ash_container`) `utils/ash_helpers.ps1` (`Invoke-ASH`)	An empty ASH_IMAGE_NAME names no image, as in ./ash and Invoke-ASH. (`automated_security_helper/interactions/run_ash_container.py`, `run_ash_container`)
`ASH_IN_CONTAINER`	`NO`	`YES` (core)	`automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`) `automated_security_helper/interactions/run_ash_scan.py` (`_live_progress_enabled`) `automated_security_helper/utils/log.py` (`get_logger`) `automated_security_helper/utils/scan_source.py` (`_in_container`)	Set by the ASH image itself (Dockerfile: `ENV ASH_IN_CONTAINER="YES"`). (`automated_security_helper/utils/scan_source.py`)
`ASH_IN_NIX`	`NO`		`automated_security_helper/interactions/run_ash_nix.py` (`run_ash_nix`) `automated_security_helper/interactions/run_ash_scan.py` (`_log_files_the_nix_host_opened`)	Recursion guard, following the existing ASH_IN_CONTAINER precedent. The inner invocation is rewritten to --mode local, so this should never be observed as already set; it is checked anyway because the alternative to a loud failure is a fork bomb. (`automated_security_helper/interactions/run_ash_nix.py`)
`ASH_LOG_LEVEL`			`automated_security_helper/utils/log.py` (`_last_resort_level`)	The level the last resort takes homeless records at: ASH_LOG_LEVEL when the environment names a level, WARNING otherwise. (`automated_security_helper/utils/log.py`, `_last_resort_level`)
`ASH_LOG_TO_STDERR`	`NO`		`automated_security_helper/utils/log.py` (`get_logger`)	The stdio MCP transport uses stdout as its JSON-RPC channel, and the MCP server runs scans in-process (mcp_tools hands run_ash_scan to loop.run_in_executor, i.e. a thread in the same process). (`automated_security_helper/utils/log.py`, `get_logger`)
`ASH_MCP_ALLOWED_CONFIG_ROOTS`			`automated_security_helper/cli/mcp/sandbox.py` (`operator_config_roots`)	Directories the server may read a config input from -- an `.ash.yaml`, a `.code-workspace` definition, a `--workspace-config` policy file. (`automated_security_helper/cli/mcp/sandbox.py`)
`ASH_MCP_ALLOWED_ROOTS`			`automated_security_helper/cli/mcp/sandbox.py` (`operator_scan_roots`) `automated_security_helper/cli/mcp/scan_target.py` (`_allowed_roots`)	Directories the server may scan and write an output tree into. Unchanged spelling and meaning; see the module docstring on migration. (`automated_security_helper/cli/mcp/sandbox.py`)
`ASH_MCP_GIT_ALLOWED_HOSTS`	`""`		`automated_security_helper/cli/mcp/source_delivery.py` (`_git_allowed_entries`)	Where `set_source_git` may clone from, set by the operator. Comma- or whitespace-separated `[scheme://]host[:port]` entries. A bare host stands for its scheme's default port (https 443, ssh 22) on either scheme; `host:port` names the port, and `https://` or `ssh://` the scheme. (`automated_security_helper/cli/mcp/source_delivery.py`)
`ASH_MCP_TRANSPORT`			`automated_security_helper/cli/mcp/sandbox.py` (`get_server_transport`, `unknown_transport_override`)	Which transport this process serves. Held in the environment rather than in a module global, for two reasons that a global got wrong. A module global leaks. (`automated_security_helper/cli/mcp/sandbox.py`)
`ASH_MCP_WORKSPACE_ROOT`			`automated_security_helper/cli/mcp/source_delivery.py` (`resolve_workspace_root`)	1. `$ASH_MCP_WORKSPACE_ROOT` 2. `$XDG_CACHE_HOME/ash-mcp/` 3. `~/.cache/ash-mcp/` (`automated_security_helper/cli/mcp/source_delivery.py`, `resolve_workspace_root`)
`ASH_MODE`	`local`		`automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`)	Sets `ash scan --mode`. Execution mode preset. 'local' (default) runs the scan in this process with the scanner tools installed on this machine. 'precommit' is a local scan that runs only bandit, detect-secrets, checkov, cdk-nag, npm-audit, plus any --scanners, with simplified output and no progress display; in workspace mode it changes only the output. 'container' builds the ASH container image and runs the scan inside it. 'nix' runs the scan inside `nix develop`, whose shell supplies pinned scanner versions, and always offline.
`ASH_NIX_FLAKE_REF`			`automated_security_helper/interactions/run_ash_nix.py` (`resolve_flake_ref`)	Overrides which flake supplies the toolchain. Documented because the default cannot be right for every installation, and a wrong flake reference otherwise produces a Nix error with no hint that it is configurable. (`automated_security_helper/interactions/run_ash_nix.py`)
`ASH_OCI_RUNNER`			`utils/ash_helpers.ps1` (`Invoke-ASH`)	Purpose not documented in code.
`ASH_OFFLINE`	`NO`	`${OFFLINE}` (core)	`automated_security_helper/cli/config.py` (`wizard`) `automated_security_helper/core/constants.py` (`is_offline_mode`) `automated_security_helper/utils/process_env.py` (`hold_environ`, `release_environ`)	Check if ASH is running in offline mode via ASH_OFFLINE env var. (`automated_security_helper/core/constants.py`, `is_offline_mode`)
`ASH_OFFLINE_AT_BUILD_TIME`	`NO`	`${OFFLINE}` (core)	`automated_security_helper/utils/content_databases.py` (`built_offline`)	Set by the Dockerfile from its `OFFLINE` build argument (`ENV ASH_OFFLINE_AT_BUILD_TIME="${OFFLINE}"`), so it is `YES` in an image built with `OFFLINE=YES`; nothing else in ASH sets it, and ASH reads it wherever it is set. (`automated_security_helper/utils/content_databases.py`)
`ASH_OUTPUT_DIR`	not set required		`automated_security_helper/cli/merge.py` (`merge_command`) `automated_security_helper/cli/report.py` (`report_command`) `automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`)	Sets `ash merge --output-dir`. Directory to write the merged results and reports to. Sets `ash report --output-dir`. The directory to output results to Sets `ash scan --output-dir`. The directory to output results to
`ASH_OUTPUT_FORMAT`	`text`		`utils/grype-docker-execute.sh` (top level) `utils/js-docker-execute.sh` (top level) `utils/yaml-docker-execute.sh` (top level)	Purpose not documented in code.
`ASH_PINS_DIR`		`/ash-pins` (core)	`automated_security_helper/assets/install-pinned-tool.py` (`default_package_root`)	`ASH_PINS_DIR` first, which is what the Dockerfile sets, then the checkout layout inferred from this file's own location -- assets/ and utils/ are siblings -- so the script is runnable and testable straight from a clone with no environment set up. (`automated_security_helper/assets/install-pinned-tool.py`, `default_package_root`)
`ASH_PLUGIN_MODULES`	not set		`automated_security_helper/cli/plugin.py` (`list_plugins`) `automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`) `automated_security_helper/config/plugin_module_trust.py` (`environment_plugin_modules`)	Sets `ash plugin list --ash-plugin-modules`, `ash scan --ash-plugin-modules`. List of Python modules to import containing ASH plugins and/or event subscribers. These are loaded in addition to the default modules.
`ASH_PROJECT_NAME`	`ash-scan`		`automated_security_helper/config/ash_config.py` (`AshConfig`)	Sets the default of `project_name`.
`ASH_ROOT_DIR`	`""`		`utils/ash_helpers.sh` (top level)	A refusal returns 3, the code ASH uses for input it refuses, as ./ash and Invoke-ASH do. It returns from the sourced file and does not end the shell that sourced it. (`utils/ash_helpers.sh`)
`ASH_S3_BUCKET_NAME`	`null` (the default of `reporters.s3.options.bucket_name`)		`automated_security_helper/config/ash_config.py` (`reporter_default_values`) `automated_security_helper/plugin_modules/ash_aws_plugins/s3_reporter.py` (`S3ReporterConfigOptions`)	Sets the default of `reporters.s3.options.bucket_name`.
`ASH_SCANNERS`	not set		`automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`)	Sets `ash scan --scanners`. Specific scanner names to run. Defaults to all scanners.
`ASH_SCAN_SOURCE`			`automated_security_helper/utils/scan_source.py` (`recorded_scan_source`, `why_no_scan_source`)	Set by the container launcher (run_ash_container) to the label it worked out on the host, "" when it has none. Read only in a scan the launcher started. (`automated_security_helper/utils/scan_source.py`)
`ASH_SHARD_COUNT`	not set		`automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`)	Sets `ash scan --shard-count`. Total number of shards this scan is split across. Requires --shard-index. Balance is by scanner count rather than scanner cost, so counts above about four buy little: wall clock is bounded by the slowest single scanner.
`ASH_SHARD_INDEX`	not set		`automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`)	Sets `ash scan --shard-index`. Zero-based index of this shard when one scan is split across several executors. Requires --shard-count. A 3-way split uses indices 0, 1 and 2. Each shard runs a disjoint subset of the scanners and records which ones in its results; recombine them with 'ash merge'.
`ASH_SOURCE_DIR`	not set		`automated_security_helper/cli/config.py` (`get`, `lint`, `validate`, `validate_plugin_dependencies`) `automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`)	Sets `ash config get --source-dir`. The directory a scan would scan, as `ash scan --source-dir`: the config is discovered there unless --config names one, and a config inside it may only extend files inside it. Defaults to the current directory. Sets `ash config lint --source-dir`. The directory a scan would scan, as `ash scan --source-dir`: the config is discovered there unless --config names one, and a config inside it may only extend files inside it. Defaults to the current directory. Sets `ash config validate --source-dir`. The directory a scan would scan, as `ash scan --source-dir`: the config is discovered there unless --config names one, and a config inside it may only extend files inside it. Defaults to the current directory. Sets `ash config validate-plugin-dependencies --source-dir`. The directory a scan would scan, as `ash scan --source-dir`: the config is discovered there unless --config names one, and a config inside it may only extend files inside it. Defaults to the current directory. Sets `ash scan --source-dir`. The source directory to scan
`ASH_STATE_DIR`	`""`		`automated_security_helper/interactions/container_leftovers.py` (`state_dir`)	Names the state directory outright; otherwise `~/.ash/state/containers`. (`automated_security_helper/interactions/container_leftovers.py`)
`ASH_THIRD_PARTY_DIR`			`automated_security_helper/assets/install-pinned-tool.py` (`main`, `third_party_main`)	Set by the Dockerfile's core stage. Unset, `install-pinned-tool <tool>` installs the executable only, which is what the uv-reqs stage and a developer want. (`automated_security_helper/assets/install-pinned-tool.py`)
`ASH_TOOL_DOWNLOAD_CACHE`	`""`		`automated_security_helper/utils/download_utils.py` (`_tool_download_cache`)	Directory of release assets kept between runs, set by CI (ASH_TOOL_DOWNLOAD_CACHE). It holds the downloaded release ASSETS, never extracted binaries and never install receipts. (`automated_security_helper/utils/download_utils.py`)
`ASH_VERBOSE`	off		`automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`) `automated_security_helper/core/execution_engine.py` (`ScanExecutionEngine.__init__`) `automated_security_helper/interactions/run_ash_scan.py` (`_env_flag`)	Sets `ash scan --verbose`. Enable verbose logging. Any log flag on the command line overrides ASH_VERBOSE.
`ASH_WORD_AT`			`ash` (`detect_subcommand`)	Purpose not documented in code.
`ASH_WORKSPACE`	not set		`automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`)	Sets `ash scan --workspace`. Path to a '.code-workspace' file whose folders are scanned as separate, independently-scoped projects. Pass 'auto' to use the single '*.code-workspace' file in the current directory. Mutually exclusive with --source-dir.
`ASH_WORKSPACE_CONFIG`	not set		`automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`)	Sets `ash scan --workspace-config`. Path to the workspace policy file (severity ceiling, workspace-wide suppressions and ignore paths, additional scanners). Without this, ASH looks for 'ash-workspace.{yaml,yml,json}' in the workspace root or its '.ash' directory; finding none is not an error. Must not be any project's own ASH config: workspace policy governs every project, so reading one project's config as policy would apply its settings to its siblings.

Variables from other tools and the platform¶

Variables a configuration file can read¶

A value in a configuration file that begins with ${NAME} or ${NAME:default} has the reference replaced by that environment variable. Only names that start with ASH_ and these names are substituted: AWS_DEFAULT_REGION, AWS_PROFILE, AWS_REGION. Any other reference is left as written, with a warning. The prefix and the list are defined in automated_security_helper/core/constants.py.

Lookups that could not be resolved¶

These reads take the variable name from a value the generator cannot resolve without running ASH: a name read from a configuration file, built at run time, or passed in from somewhere it cannot follow. A variable read only through one of these sites is not in the tables above.

automated_security_helper/config/ash_config.py (resolve_env_references) [environ.get] resolved_var = os.environ.get(var_name, None)
automated_security_helper/config/config_sources.py (_empty_key_reference_names.walk) [environ.get] if resolved is None and os.environ.get(name) is not None:
automated_security_helper/config/config_validator.py (_reference_variable_is_set) [environ.get] return reference is None or os.environ.get(reference.group(1)) is not None
automated_security_helper/config/environment_record.py (_value_read) [environ.get] value = os.environ.get(name)
automated_security_helper/core/constants.py (xdg_directory) [environ.get] value = os.environ.get(variable, "")
automated_security_helper/interactions/run_ash_container.py (_carried_values_by_band) [environ.get] value = os.environ.get(name, "")
automated_security_helper/interactions/run_ash_container.py (_runner_marker_args) [environ.get] value = environ.get(name)
automated_security_helper/interactions/run_ash_container.py (_write_env_file) [environ.get] if any(char in environ.get(name, "") for char in "\n\r\0"):
automated_security_helper/interactions/run_ash_container.py (_write_env_file) [presence check] if name in environ:
automated_security_helper/interactions/run_ash_container.py (_write_env_file) [subscript] handle.write(f"{name}={environ[name]}\n")
automated_security_helper/interactions/run_ash_container.py (run_ash_container) [environ.get] for value in (os.environ.get(name, ""),)
automated_security_helper/plugin_modules/ash_builtin/scanners/grype_scanner.py (_declared_grype_db_bound) [presence check] if name not in environ and config_key_for_env.get(name) not in user_config_keys
automated_security_helper/utils/log.py (_detect_encoding_issues) [presence check] is_ci = any(name in os.environ for name in ("CI", *_CI_RUNNER_MARKERS))
automated_security_helper/utils/log.py (configure_windows_safe_logging) [presence check] is_ci = any(name in os.environ for name in ("CI", *_CI_RUNNER_MARKERS))
automated_security_helper/utils/process_env.py (apply_environ_overrides) [environ.get] previous = {key: os.environ.get(key) for key in overrides}
automated_security_helper/utils/process_env.py (apply_environ_overrides) [environ.pop] os.environ.pop(key, None)
automated_security_helper/utils/process_env.py (restore_environ) [environ.pop] os.environ.pop(key, None)
automated_security_helper/utils/sandbox/policy.py (_env_named_read_paths) [environ.get] value = os.environ.get(name, "")

Variable	Default	Container image	Read at	Purpose
`ACTIONS_CACHE_URL`			`automated_security_helper/interactions/run_ash_container.py` (`_gha_layer_cache_args`)	The exporter authenticates with ACTIONS_RUNTIME_TOKEN and talks to ACTIONS_CACHE_URL (protocol v1) or ACTIONS_RESULTS_URL (v2). (`automated_security_helper/interactions/run_ash_container.py`, `_gha_layer_cache_args`)
`ACTIONS_RESULTS_URL`			`automated_security_helper/interactions/run_ash_container.py` (`_gha_layer_cache_args`)	The exporter authenticates with ACTIONS_RUNTIME_TOKEN and talks to ACTIONS_CACHE_URL (protocol v1) or ACTIONS_RESULTS_URL (v2). (`automated_security_helper/interactions/run_ash_container.py`, `_gha_layer_cache_args`)
`ACTIONS_RUNTIME_TOKEN`			`automated_security_helper/interactions/run_ash_container.py` (`_gha_layer_cache_args`)	The exporter authenticates with ACTIONS_RUNTIME_TOKEN and talks to ACTIONS_CACHE_URL (protocol v1) or ACTIONS_RESULTS_URL (v2). (`automated_security_helper/interactions/run_ash_container.py`, `_gha_layer_cache_args`)
`APPVEYOR`			`automated_security_helper/utils/log.py` (`_on_a_ci_runner`)	Variables a CI runner sets, any value counting: GitHub Actions, Azure Pipelines, TeamCity, Jenkins, CodeBuild, GitLab CI, Buildkite, CircleCI, Travis CI, AppVeyor, Bitbucket Pipelines and Bamboo, which can set one of these alone. (`automated_security_helper/utils/log.py`)
`AWS_DEFAULT_REGION`	`us-east-1`		`automated_security_helper/plugin_modules/ash_aws_plugins/bedrock_summary_reporter.py` (`BedrockSummaryReporterConfigOptions`) `automated_security_helper/plugin_modules/ash_aws_plugins/cloudwatch_logs_reporter.py` (`CloudWatchLogsReporterConfigOptions`) `automated_security_helper/plugin_modules/ash_aws_plugins/s3_reporter.py` (`S3ReporterConfigOptions`) `automated_security_helper/plugin_modules/ash_aws_plugins/security_hub_reporter.py` (`SecurityHubReporterConfigOptions`)	Sets the default of `reporters.aws-security-hub.options.aws_region`, `reporters.bedrock-summary-reporter.options.aws_region`, `reporters.cloudwatch-logs.options.aws_region`, `reporters.s3.options.aws_region`.
`AWS_PROFILE`	`null` (the default of `reporters.aws-security-hub.options.aws_profile`) `null` (the default of `reporters.bedrock-summary-reporter.options.aws_profile`) `null` (the default of `reporters.s3.options.aws_profile`)		`automated_security_helper/plugin_modules/ash_aws_plugins/bedrock_summary_reporter.py` (`BedrockSummaryReporterConfigOptions`) `automated_security_helper/plugin_modules/ash_aws_plugins/s3_reporter.py` (`S3ReporterConfigOptions`) `automated_security_helper/plugin_modules/ash_aws_plugins/security_hub_reporter.py` (`SecurityHubReporterConfigOptions`)	Sets the default of `reporters.aws-security-hub.options.aws_profile`, `reporters.bedrock-summary-reporter.options.aws_profile`, `reporters.s3.options.aws_profile`.
`AWS_REGION`	`os.environ.get("AWS_DEFAULT_REGION", "us-east-1")` `os.environ.get("AWS_DEFAULT_REGION", None)`		`automated_security_helper/plugin_modules/ash_aws_plugins/bedrock_summary_reporter.py` (`BedrockSummaryReporterConfigOptions`) `automated_security_helper/plugin_modules/ash_aws_plugins/cloudwatch_logs_reporter.py` (`CloudWatchLogsReporterConfigOptions`) `automated_security_helper/plugin_modules/ash_aws_plugins/s3_reporter.py` (`S3ReporterConfigOptions`) `automated_security_helper/plugin_modules/ash_aws_plugins/security_hub_reporter.py` (`SecurityHubReporterConfigOptions`)	Sets the default of `reporters.aws-security-hub.options.aws_region`, `reporters.bedrock-summary-reporter.options.aws_region`, `reporters.cloudwatch-logs.options.aws_region`, `reporters.s3.options.aws_region`.
`AZURE_PIPELINES`			`automated_security_helper/utils/log.py` (`_on_a_ci_runner`)	Variables a CI runner sets, any value counting: GitHub Actions, Azure Pipelines, TeamCity, Jenkins, CodeBuild, GitLab CI, Buildkite, CircleCI, Travis CI, AppVeyor, Bitbucket Pipelines and Bamboo, which can set one of these alone. (`automated_security_helper/utils/log.py`)
`BITBUCKET_BUILD_NUMBER`			`automated_security_helper/utils/log.py` (`_on_a_ci_runner`)	Variables a CI runner sets, any value counting: GitHub Actions, Azure Pipelines, TeamCity, Jenkins, CodeBuild, GitLab CI, Buildkite, CircleCI, Travis CI, AppVeyor, Bitbucket Pipelines and Bamboo, which can set one of these alone. (`automated_security_helper/utils/log.py`)
`BUILDKITE`			`automated_security_helper/utils/log.py` (`_on_a_ci_runner`)	Variables a CI runner sets, any value counting: GitHub Actions, Azure Pipelines, TeamCity, Jenkins, CodeBuild, GitLab CI, Buildkite, CircleCI, Travis CI, AppVeyor, Bitbucket Pipelines and Bamboo, which can set one of these alone. (`automated_security_helper/utils/log.py`)
`CFG_I`			`ash` (top level)	Purpose not documented in code.
`CI`	`""`		`automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`) `automated_security_helper/interactions/run_ash_scan.py` (`_live_progress_enabled`) `automated_security_helper/utils/log.py` (`_on_a_ci_runner`)	It is utils/console.py's print, not rich's: its console checks each line it writes off a terminal, so none reads as a CI command. (`automated_security_helper/cli/scan.py`)
`CIRCLECI`			`automated_security_helper/utils/log.py` (`_on_a_ci_runner`)	Variables a CI runner sets, any value counting: GitHub Actions, Azure Pipelines, TeamCity, Jenkins, CodeBuild, GitLab CI, Buildkite, CircleCI, Travis CI, AppVeyor, Bitbucket Pipelines and Bamboo, which can set one of these alone. (`automated_security_helper/utils/log.py`)
`CODEBUILD_BUILD_ID`			`automated_security_helper/utils/log.py` (`_on_a_ci_runner`)	Variables a CI runner sets, any value counting: GitHub Actions, Azure Pipelines, TeamCity, Jenkins, CodeBuild, GitLab CI, Buildkite, CircleCI, Travis CI, AppVeyor, Bitbucket Pipelines and Bamboo, which can set one of these alone. (`automated_security_helper/utils/log.py`)
`CONTAINER_HOST`			`automated_security_helper/interactions/container_leftovers.py` (`_daemon_environment`)	Purpose not documented in code.
`DOCKER_CONTEXT`			`automated_security_helper/interactions/container_leftovers.py` (`_daemon_environment`)	Purpose not documented in code.
`DOCKER_EXTRA_ARGS`	`""`		`ash` (top level)	Purpose not documented in code.
`DOCKER_HOST`			`automated_security_helper/interactions/container_leftovers.py` (`_daemon_environment`)	Purpose not documented in code.
`FORCE_COLOR`			`automated_security_helper/utils/console.py` (`typer_console`)	For what ASH prints in typer's place, a usage error and an escaping exception's traceback, so they look as typer prints them: typer's theme and option highlighter, its color system, a terminal forced under GITHUB_ACTIONS, FORCE_COLOR or PY_COLORS (whose logs show color) and turned off by _TYPER_FORCE_DISABLE_TERMINAL, ... (`automated_security_helper/utils/console.py`, `typer_console`)
`GITHUB_ACTIONS`			`automated_security_helper/utils/command_safe_stream.py` (`_under_a_command_reading_runner`) `automated_security_helper/utils/console.py` (`typer_console`) `automated_security_helper/utils/log.py` (`_on_a_ci_runner`)	The variable each runner that reads workflow commands from a job's output sets in every job: GitHub Actions, Azure Pipelines, TeamCity. Container mode and ./ash pass each one that is set into the container, so the scan there checks a terminal's lines too. (`automated_security_helper/utils/command_safe_stream.py`)
`GITLAB_CI`			`automated_security_helper/utils/log.py` (`_on_a_ci_runner`)	Variables a CI runner sets, any value counting: GitHub Actions, Azure Pipelines, TeamCity, Jenkins, CodeBuild, GitLab CI, Buildkite, CircleCI, Travis CI, AppVeyor, Bitbucket Pipelines and Bamboo, which can set one of these alone. (`automated_security_helper/utils/log.py`)
`GITLEAKS_CONFIG`			`automated_security_helper/plugin_modules/ash_builtin/scanners/gitleaks_scanner.py` (`GitleaksScanner._rescan_env`, `GitleaksScanner._resolve_config_file`)	Environment variables gitleaks reads a config from. When either is set, outside the scanner sandbox, ASH does not pass `gitleaks --config` and gitleaks resolves it. (`automated_security_helper/plugin_modules/ash_builtin/scanners/gitleaks_scanner.py`)
`GITLEAKS_CONFIG_TOML`			`automated_security_helper/plugin_modules/ash_builtin/scanners/gitleaks_scanner.py` (`GitleaksScanner._resolve_config_file`)	Environment variables gitleaks reads a config from. When either is set, outside the scanner sandbox, ASH does not pass `gitleaks --config` and gitleaks resolves it. (`automated_security_helper/plugin_modules/ash_builtin/scanners/gitleaks_scanner.py`)
`GIT_CEILING_DIRECTORIES`	`""`		`automated_security_helper/utils/scan_output_dirs.py` (`_repository_root_of`) `automated_security_helper/utils/scan_source.py` (`_ceiling_entries`)	`GIT_CEILING_DIRECTORIES` is honored as git honors it: directory itself is always looked at, listed or not, and the search stops before it would move up into a listed directory. (`automated_security_helper/utils/scan_output_dirs.py`, `_repository_root_of`)
`GIT_DIR`			`automated_security_helper/utils/scan_source.py` (`_a_git_entry_may_exist`)	True with a `.git` entry (of any kind: directory, file, symlink) in the directory or one of its parents, with GIT_DIR or GIT_WORK_TREE in environ, which point git at a repository wherever it runs, or whenever the walk cannot be sure: a directory that cannot be resolved, or a parent whose `.git` entry cannot be ... (`automated_security_helper/utils/scan_source.py`, `_a_git_entry_may_exist`)
`GIT_WORK_TREE`			`automated_security_helper/utils/scan_source.py` (`_a_git_entry_may_exist`)	True with a `.git` entry (of any kind: directory, file, symlink) in the directory or one of its parents, with GIT_DIR or GIT_WORK_TREE in environ, which point git at a repository wherever it runs, or whenever the walk cannot be sure: a directory that cannot be resolved, or a parent whose `.git` entry cannot be ... (`automated_security_helper/utils/scan_source.py`, `_a_git_entry_may_exist`)
`GRYPE_DB_CACHE_DIR`		`/deps/.grype` (core)	`automated_security_helper/utils/offline_mode_validator.py` (`validate_grype_offline_mode`) `utils/grype-docker-execute.sh` (top level)	Check for GRYPE_DB_CACHE_DIR environment variable (`automated_security_helper/utils/offline_mode_validator.py`, `validate_grype_offline_mode`)
`HOME`	`""`	`${ASHUSER_HOME}` (non-root)	`automated_security_helper/core/constants.py` (`usable_home`, `warn_if_home_unusable`)	On POSIX it is HOME when HOME is set, not empty, and absolute. (`automated_security_helper/core/constants.py`, `usable_home`)
`JENKINS_URL`			`automated_security_helper/utils/log.py` (`_on_a_ci_runner`)	Variables a CI runner sets, any value counting: GitHub Actions, Azure Pipelines, TeamCity, Jenkins, CodeBuild, GitLab CI, Buildkite, CircleCI, Travis CI, AppVeyor, Bitbucket Pipelines and Bamboo, which can set one of these alone. (`automated_security_helper/utils/log.py`)
`JSII_NODE`			`automated_security_helper/utils/cdk_nag_wrapper.py` (`run_cdk_nag_against_cfn_template`)	jsii starts JSII_NODE, or "node" by name, which on Windows is looked for in the working directory first; this process runs in ASH's, usually the repository being scanned. So it is given the node ASH resolved, as an absolute path. (`automated_security_helper/utils/cdk_nag_wrapper.py`, `run_cdk_nag_against_cfn_template`)
`LC_ALL`			`utils/ash_helpers.ps1` (`Invoke-ASH.Get-AshFirstLine`)	Purpose not documented in code.
`LS_UID`			`ash` (`git_entry_trusted`, `ls_mode_and_owner`)	Purpose not documented in code.
`MKDIR_REASON`	`mkdir did not make it`		`ash` (top level)	Purpose not documented in code.
`NO_COLOR`			`automated_security_helper/cli/report.py` (`report_command`)	`pretty` is color being on (no `--no-color`, no NO_COLOR); it takes effect only when stream is an interactive terminal. (`automated_security_helper/cli/report.py`, `_write_report`)
`NPM_CONFIG_CACHE`			`automated_security_helper/utils/offline_mode_validator.py` (`validate_npm_audit_offline_mode`)	Purpose not documented in code.
`OCI_RUNNER`	`$(command -v finch \|\| command -v docker \|\| command -v nerdctl \|\| command -v podman)` `""`		`ash` (top level) `automated_security_helper/cli/image.py` (`build_ash_image_cli_command`) `automated_security_helper/cli/scan.py` (`run_ash_scan_cli_command`) `utils/ash_helpers.ps1` (`Invoke-ASH`)	Sets `ash build-image --oci-runner`. Use the specified OCI runner instead of docker to run the containerized tools. To prefix every OCI command with a wrapper (e.g. sudo), set the OCI_RUNNER_WRAPPER environment variable instead of using this option (e.g. OCI_RUNNER_WRAPPER=sudo ash ...). Sets `ash scan --oci-runner`. Use the specified OCI runner instead of docker to run the containerized tools
`OCI_RUNNER_WRAPPER`	`""`		`ash` (top level) `automated_security_helper/interactions/run_ash_container.py` (`_get_oci_wrapper_prefix`) `utils/ash_helpers.ps1` (`Invoke-ASH`)	OCI_RUNNER_WRAPPER prefixes all OCI commands (like RUSTC_WRAPPER for cargo) Example: OCI_RUNNER_WRAPPER=sudo makes all finch/docker calls use sudo (`ash`)
`OPENGREP_RULES_CACHE_DIR`	`""`	`/deps/.opengrep` (core)	`automated_security_helper/plugin_modules/ash_builtin/scanners/_grep_scanner_base.py` (`GrepScannerBase._configure_offline_mode`, `GrepScannerBase.content_database_probe_context`)	Purpose not documented in code.
`PATH`	`""` `os.defpath`	`/root/.local/bin:$PATH` (uv-reqs) `/root/.local/bin:$PATH` (core) `/usr/local/bin:$PATH` (core) `${ASH_BIN_PATH}:$PATH` (core) `${ASHUSER_HOME}/.local/bin:$PATH` (non-root)	`automated_security_helper/assets/install-pinned-tool.py` (`_absolute_entries`) `automated_security_helper/utils/sandbox/backends.py` (`_probe_env`) `automated_security_helper/utils/sandbox/policy.py` (`_path_directories`) `automated_security_helper/utils/subprocess_utils.py` (`_absolute_path_entries`, `_lookup`, `started_from_working_directory`) `automated_security_helper/utils/uv_tool_runner.py` (`_lookup_key`)	The absolute entries of `search_path`, or of PATH. (`automated_security_helper/assets/install-pinned-tool.py`, `_absolute_entries`)
`PWD`	`""`		`ash` (`carry_config_file`) `automated_security_helper/config/sandbox_grants.py` (`_logical_paths`) `automated_security_helper/interactions/run_ash_container.py` (`_name_from_the_logical_directory`) `utils/yaml-docker-execute.sh` (top level)	ASH builds an absolute scan root from the physical working directory, so a root whose text starts with it is rejoined to `$PWD` from the rest of its text, `..` and symlinks included. (`automated_security_helper/config/sandbox_grants.py`, `_logical_paths`)