diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 1446dff3..7f7617f9 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -12,3 +12,8 @@
 **Vulnerability:** The redaction regex `KV_PATTERN` failed to match and redact quoted secret values (e.g., `password="mysecret"`), potentially leaking credentials in audit logs.
 **Learning:** Regular expressions for sanitizing key=value pairs must account for quoted values by explicitly including `"[^"]*"` and `'[^']*'` in the matching group.
 **Prevention:** When writing regex for secrets matching, always include patterns for both quoted and unquoted strings to prevent simple bypasses.
+
+## 2026-10-24 - Fix execa extendEnv for missing sanitizeEnvironment
+**Vulnerability:** Found more instances where execa is called with `extendEnv: false` missing and process.env is exposed directly via the default extendEnv, specifically in runner capabilities and CLI auth scripts.
+**Learning:** `execa` defaulting to `extendEnv: true` is a very dangerous default since we have secret env keys.
+**Prevention:** Make sure all references to `execa` get `extendEnv: false` combined with `sanitizeEnvironment`.
diff --git a/src/cli/authorization/non-interactive.ts b/src/cli/authorization/non-interactive.ts
index 369e269b..9800a5bd 100644
--- a/src/cli/authorization/non-interactive.ts
+++ b/src/cli/authorization/non-interactive.ts
@@ -11,6 +11,7 @@ import type {
 import {
   getLogger,
   McpConnectionManager,
+  sanitizeEnvironment,
 } from '../../core/facades/cli-authorization-non-interactive.js';
 import { isRecord } from '../../core/facades/cli-utils-serialize.js';
 import { text } from '../locales/index.js';
@@ -101,6 +102,8 @@ export async function requestNonInteractiveAuthorizationDecision(params: {
         shell: true,
         timeout: timeoutMs,
         reject: false,
+        env: sanitizeEnvironment(process.env),
+        extendEnv: false,
       });
 
       if (typeof res.exitCode === 'number' && res.exitCode !== 0) {
diff --git a/src/core/facades/cli-authorization-non-interactive.ts b/src/core/facades/cli-authorization-non-interactive.ts
index 63dd39f2..deb8a1df 100644
--- a/src/core/facades/cli-authorization-non-interactive.ts
+++ b/src/core/facades/cli-authorization-non-interactive.ts
@@ -6,3 +6,4 @@ export type {
   AuthorizationDecision,
   ToolAuthorizationRequest,
 } from '../tools/authorization/types.js';
+export { sanitizeEnvironment } from '../utils/sanitizer.js';
diff --git a/src/core/tools/capability/runner.ts b/src/core/tools/capability/runner.ts
index dbba2080..91c71c9d 100644
--- a/src/core/tools/capability/runner.ts
+++ b/src/core/tools/capability/runner.ts
@@ -1,5 +1,7 @@
 import { execa } from 'execa';
 
+import { sanitizeEnvironment } from '../../utils/sanitizer.js';
+
 import { ExecOpts, ExecResult } from './types.js';
 
 /**
@@ -15,7 +17,8 @@ export function createControlledRunner() {
           cwd: opts?.cwd,
           timeout: opts?.timeoutMs,
           maxBuffer: opts?.maxStdoutBytes,
-          env: opts?.env,
+          env: sanitizeEnvironment(opts?.env ? { ...process.env, ...opts.env } : process.env),
+          extendEnv: false,
           reject: false, // Backends should handle exit codes themselves
         });
 
diff --git a/tests/helpers/bun-test-harness.ts b/tests/helpers/bun-test-harness.ts
index abd43ad6..97e193bf 100644
--- a/tests/helpers/bun-test-harness.ts
+++ b/tests/helpers/bun-test-harness.ts
@@ -142,7 +142,9 @@ export function restoreConsoleOutputs() {
 
 export function clearMockState() {
   mock.restore();
-  mock.clearAllMocks();
+  if (typeof mock.clearAllMocks === 'function') {
+    mock.clearAllMocks();
+  }
   auditTrail.clearAuditTrail();
 }