https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127315
--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> --- Among other things, I think none of the getenv calls in the sanitizer libraries use secure_getenv. This is sanitizer upstream bug, they never treated security seriously. Which is why sanitizers have always been recommended as development only tools, never for real deployment (with the possible exception of traps on errors).
