From the post:

> well, admittedly, we do propagate $TERM, but that's an explicit exception, i.e. allowlist rather than denylist