Zsh Export Command
The zsh export command sets a shell value and shares it with child tasks. You run this built-in action to pass settings or keys to tools you start. Teams often use this action to store database logins and API keys on laptops. That approach works fast, but broad roles and static local keys create major risks. If a key sits in a startup file, every local script can read it. How the zsh export command works When you set a basic shell value, it stays inside your current window. Other apps and sc
GCP Security Command Center: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
The zsh export command sets a shell value and shares it with child tasks. You run this built-in action to pass settings or keys to tools you start.
Teams often use this action to store database logins and API keys on laptops. That approach works fast, but broad roles and static local keys create major risks. If a key sits in a startup file, every local script can read it.
How the zsh export command works
When you set a basic shell value, it stays inside your current window. Other apps and scripts that you launch from that window will not see it. The zsh export command changes the scope of that local value right away. It marks the value so the shell copies it into every new child process.
Each new process gets its own copy of the exported values at launch time. If a child script changes its copy, the parent shell does not see that change. The flow of data only goes one way, from parent to child.
To keep values across reboots, engineers write them into shell startup files on disk. Each time you open a terminal window, the shell reads those files and loads them. This workflow makes local tool setup fast for daily work across a team. Your CLI tools find the endpoints, regions, and keys they need right away.
Where local shell files fall short
Storing plain text values in shell startup files solves the local setup problem. It tells your local tools how to log in to remote cloud services. Still, this native shell setup leaves a big gap in day-to-day security.
Plain text keys on a laptop disk remain valid until someone rotates them. Any third-party script or bad package you run inherits those exported values. A simple build script can read your database key and send it out.
GCP Security Command Center: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Also, static keys only decide who can log in to a remote system. They do not check or limit what individual commands do during an active session. Once a tool logs in with an exported key, it has full role rights. If that role is broad, one bad command can drop tables or read customer data. Central logs on the server only show the shared account name, not the person. Teams also struggle to keep keys updated across dozens of developer laptops. When an engineer leaves the team, admins must rotate every shared secret by hand. You also cannot mask sensitive fields like emails, phone numbers, or card numbers in flight.
Safer ways to handle local values
Teams can reduce risk by keeping plain text secrets out of shell startup files. Keep your startup files strictly for safe settings like text editors and folder paths. Load sensitive keys only inside the single terminal session that needs them right now.
Clear your shell history and close the window as soon as the task ends. Use short-lived sessions instead of long-lived keys whenever your cloud tools allow it. Scope each role down to the minimum rights needed for the specific task.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What is the difference between setting a value and exporting it in Zsh?
Setting a value keeps it inside the current shell window only. Exporting the value passes a copy to any child app or script you start.
Why do exported values disappear when I close my terminal window?
Exported values live in memory for that single session only. To keep them for future sessions, you must add them to a startup file.
Can a child script change an exported value in the parent shell?
No, the child process only gets its own separate copy when it starts. Changes made inside the child script disappear when that script finishes its run.