From 300fff092e0fdfbe6ee64f6f1d58d2ce7826a99b Mon Sep 17 00:00:00 2001
From: Robert Fekete <fekete77.robert@gmail.com>
Date: Fri, 11 Nov 2022 07:10:27 +0100
Subject: [PATCH] Add link to security policy from getenv.md (#1746)

Co-authored-by: Joe Mooring <joe@mooring.com>
---
 content/en/functions/getenv.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/content/en/functions/getenv.md b/content/en/functions/getenv.md
index f7f71d35c..93e93a382 100644
--- a/content/en/functions/getenv.md
+++ b/content/en/functions/getenv.md
@@ -41,3 +41,6 @@ And then retrieve the values within a template:
 {{ os.Getenv "MY_VAR1" }} --> foo
 {{ os.Getenv "MY_VAR2" }} --> bar
 ```
+
+With Hugo v0.91.0 and later, you must explicitly allow access to environment variables. For details, review [Hugo's Security Policy](/about/security-model/#security-policy). By default, environment variables beginning with `HUGO_` are allowed when using the `os.Getenv` function.
+