{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Docs/issues/303","labels_url":"https://api.github.com/repos/aspnet/Docs/issues/303/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Docs/issues/303/comments","events_url":"https://api.github.com/repos/aspnet/Docs/issues/303/events","html_url":"https://github.com/aspnet/Docs/issues/303","id":87606652,"number":303,"title":"configuration.rst need security warning call AddEnvironmentVariables last","user":{"login":"Rick-Anderson","id":3605364,"avatar_url":"https://avatars.githubusercontent.com/u/3605364?v=3","gravatar_id":"","url":"https://api.github.com/users/Rick-Anderson","html_url":"https://github.com/Rick-Anderson","followers_url":"https://api.github.com/users/Rick-Anderson/followers","following_url":"https://api.github.com/users/Rick-Anderson/following{/other_user}","gists_url":"https://api.github.com/users/Rick-Anderson/gists{/gist_id}","starred_url":"https://api.github.com/users/Rick-Anderson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Rick-Anderson/subscriptions","organizations_url":"https://api.github.com/users/Rick-Anderson/orgs","repos_url":"https://api.github.com/users/Rick-Anderson/repos","events_url":"https://api.github.com/users/Rick-Anderson/events{/privacy}","received_events_url":"https://api.github.com/users/Rick-Anderson/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-06-12T04:59:04Z","updated_at":"2015-06-26T18:17:01Z","closed_at":null,"body":"@ardalis @danroth27 \r\n\"Essentially, the last configuration source specified “wins” if a setting exists in more than one location.\"\r\n\r\nRemove essentially, it's not essentially, it's actually. Then add a security note that AddEnvironmentVariables should always be called last because you want env variable to win.\r\n@Eilon @blowdart  we need security approval of this assertion."},"comment":{"url":"https://api.github.com/repos/aspnet/Docs/issues/comments/115822609","html_url":"https://github.com/aspnet/Docs/issues/303#issuecomment-115822609","issue_url":"https://api.github.com/repos/aspnet/Docs/issues/303","id":115822609,"user":{"login":"blowdart","id":796298,"avatar_url":"https://avatars.githubusercontent.com/u/796298?v=3","gravatar_id":"","url":"https://api.github.com/users/blowdart","html_url":"https://github.com/blowdart","followers_url":"https://api.github.com/users/blowdart/followers","following_url":"https://api.github.com/users/blowdart/following{/other_user}","gists_url":"https://api.github.com/users/blowdart/gists{/gist_id}","starred_url":"https://api.github.com/users/blowdart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blowdart/subscriptions","organizations_url":"https://api.github.com/users/blowdart/orgs","repos_url":"https://api.github.com/users/blowdart/repos","events_url":"https://api.github.com/users/blowdart/events{/privacy}","received_events_url":"https://api.github.com/users/blowdart/received_events","type":"User","site_admin":false},"created_at":"2015-06-26T18:17:01Z","updated_at":"2015-06-26T18:17:01Z","body":"Yea, I would much rather see must because it makes it clearer ordering wins, and if you want the local config to win you MUST do it. You could clarify it a little to make it clear this is why it's a must?"}}