Worked on security hardening for the longhorn-instance-manager repository, focusing on the gRPC environment variable handling during backup operations. Developed an allowlist-based restriction that limits environment variable injection in gRPC paths to a predefined set of keys, addressing the risk of privilege escalation through environment manipulation. The implementation included comprehensive unit tests to ensure only safe keys are accepted and that unsafe or malformed entries are properly rejected. Using Go and leveraging backend development and security best practices, the changes improved the reliability and auditability of credential handling in backup and restore flows, aligning with relevant security advisories and recommendations.