Electerm versions up to 3.8.15 expose the entire process.env environment variables to the renderer process via window.pre.env. This includes sensitive secrets such as AWS keys, GitHub tokens, API keys, and internal credentials. Any JavaScript execution in the renderer context, including through malicious plugins or XSS, can access and exfiltrate these secrets. The exposure is visible even without code execution by opening the Info modal, requiring local access. No patch is currently available.