     "INSECURE"
     "DEBUG"
     "YES")
-  "Environment variables to not save in `doom-env-file'.")
+  "Environment variables to not save in `doom-env-file'.
+
+Each string is a regexp, matched against variable names to omit from
+`doom-env-file'.")
 
 (defvar doom-env-executable
   (if IS-WINDOWS

          "# To auto-regenerate this file when `doom reload` is run, use `doom env auto' or\n"
          "# set DOOMENV=1 in your shell environment/config.\n"
          "# ---------------------------------------------------------------------------\n\n"))
        ;; temporarily unset ignored environment variables
        (dolist (var doom-env-ignored-vars)
          (setenv var nil))
        (let ((shell-command-switch doom-env-switches))
          (message "Scraping env from '%s %s %s'"
                   shell-file-name
                   shell-command-switch
                   doom-env-executable)
          (insert (shell-command-to-string doom-env-executable)))))))


;; Borrows heavily from Spacemacs' `spacemacs//init-spacemacs-env'.
(defun doom-reload-env-file (&optional force-p)
  "Generates `doom-env-file', if it doesn't exist (or if FORCE-P).

This scrapes the variables from your shell environment by running
`doom-env-executable' through `shell-file-name' with `doom-env-switches'. By
default, on Linux, this is '$SHELL -ic /usr/bin/env'. Variables in
`doom-env-ignored-vars' are removed."
  (when (or force-p (not (file-exists-p doom-env-file)))
    (with-temp-file doom-env-file
      (message "%s envvars file at %S"
