...

.env- → 〈TRUSTED〉

What would happen if she uncommented those variables, sourced the file, and called that endpoint?

Create .git/hooks/pre-commit :