README.md (1)

112-118: Clarify precedence and include a quick usage example.

Explicitly stating precedence reduces ambiguity and helps Docker/CI users copy-paste.

 ## Environment Variables

 Subfinder supports environment variables to specify custom paths for configuration files:

 - `SUBFINDER_CONFIG` - Path to config.yaml file (overrides default `$CONFIG/subfinder/config.yaml`)
 - `SUBFINDER_PROVIDER_CONFIG` - Path to provider-config.yaml file (overrides default `$CONFIG/subfinder/provider-config.yaml`)
+
+Precedence: CLI flags override environment variables, which override defaults.
+
+Example:
+
+```sh
+export SUBFINDER_CONFIG=/mnt/config/config.yaml
+export SUBFINDER_PROVIDER_CONFIG=/mnt/config/provider-config.yaml
+subfinder -d example.com
+```

pkg/runner/options.go (1)

121-128: Normalize env-provided paths to avoid whitespace/relative-path gotchas.

Trim and clean the paths; use LookupEnv to distinguish “unset” vs “set to empty”.

-	if envConfig := os.Getenv("SUBFINDER_CONFIG"); envConfig != "" {
-		defaultConfigLocation = envConfig
-	}
+	if v, ok := os.LookupEnv("SUBFINDER_CONFIG"); ok {
+		v = filepath.Clean(strings.TrimSpace(v))
+		if v != "" {
+			defaultConfigLocation = v
+		}
+	}
 
-	if envProviderConfig := os.Getenv("SUBFINDER_PROVIDER_CONFIG"); envProviderConfig != "" {
-		defaultProviderConfigLocation = envProviderConfig
-	}
+	if v, ok := os.LookupEnv("SUBFINDER_PROVIDER_CONFIG"); ok {
+		v = filepath.Clean(strings.TrimSpace(v))
+		if v != "" {
+			defaultProviderConfigLocation = v
+		}
+	}

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

pkg/runner/options.go (2)

160-165: Optionally auto-load config.yaml when SUBFINDER_CONFIG is set

Current logic only merges when --config differs from default. If users set SUBFINDER_CONFIG (without --config), they may expect it to load. Consider merging when the env var is present.

Apply:

- if options.Config != defaultConfigLocation {
+ if options.Config != defaultConfigLocation || os.Getenv("SUBFINDER_CONFIG") != "" {
     // An empty source file is not a fatal error
     if err := flagSet.MergeConfigFile(options.Config); err != nil && !errors.Is(err, io.EOF) {
         gologger.Fatal().Msgf("Could not read config: %s\n", err)
     }
 }

If you prefer to keep current semantics, please explicitly document that SUBFINDER_CONFIG only sets the default path and does not trigger auto-loading.

---

123-125: Nice-to-have: surface env vars in flag help

Makes discoverability better from -h alone.

- flagSet.StringVar(&options.Config, "config", defaultConfigLocation, "flag config file"),
- flagSet.StringVarP(&options.ProviderConfig, "provider-config", "pc", defaultProviderConfigLocation, "provider config file"),
+ flagSet.StringVar(&options.Config, "config", defaultConfigLocation, "flag config file (env: SUBFINDER_CONFIG)"),
+ flagSet.StringVarP(&options.ProviderConfig, "provider-config", "pc", defaultProviderConfigLocation, "provider config file (env: SUBFINDER_PROVIDER_CONFIG)"),

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

pkg/passive/sources_wo_auth_test.go (2)

47-52: Reduce bursty rate-limits to avoid 3rd‑party bans/timeouts

Using math.MaxInt32 with a 1ms window is hostile to remote services and likely contributes to flaky failures (incl. unmarshal errors on stressed endpoints).

Consider a gentler default for tests:

-		multiRateLimiter, _ = addRateLimiter(ctxParent, multiRateLimiter, source.Name(), math.MaxInt32, time.Millisecond)
+		// Reduce burst to lower risk of bans/timeouts in CI
+		multiRateLimiter, _ = addRateLimiter(ctxParent, multiRateLimiter, source.Name(), 10, 200*time.Millisecond)

If the project has per-source recommended limits, prefer wiring those instead.

Please confirm this still yields at least one result per source consistently in CI.

---

26-37: Gate “threatcrowd” ignore to CI-only

Apply in pkg/passive/sources_wo_auth_test.go:

-   "threatcrowd",    // failing with "randomly failing with unmarshal error when hit multiple times"
-}
+}
+// CI-only quarantine for flaky source; keep local coverage
+if os.Getenv("CI") != "" {
+   ignoredSources = append(ignoredSources, "threatcrowd") // intermittently fails with unmarshal errors when invoked multiple times
+}

Also add to imports:

import (
    // …
    "os"
)

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro