diff --git a/packages/node_modules/@node-red/runtime/lib/nodes/flows/index.js b/packages/node_modules/@node-red/runtime/lib/nodes/flows/index.js
index 7963ddfc4..ef9fbdab2 100644
--- a/packages/node_modules/@node-red/runtime/lib/nodes/flows/index.js
+++ b/packages/node_modules/@node-red/runtime/lib/nodes/flows/index.js
@@ -70,6 +70,7 @@ function init(runtime) {
         typeEventRegistered = true;
     }
     Flow.init(runtime);
+    flowUtil.init(runtime);
 }
 
 function loadFlows() {
@@ -676,7 +677,7 @@ const flowAPI = {
     getNode: getNode,
     handleError: () => false,
     handleStatus: () => false,
-    getSetting: k => process.env[k]
+    getSetting: k => flowUtil.getEnvVar(k)
 }
 
 
diff --git a/packages/node_modules/@node-red/runtime/lib/nodes/flows/util.js b/packages/node_modules/@node-red/runtime/lib/nodes/flows/util.js
index 220fd010e..b67ab6b43 100644
--- a/packages/node_modules/@node-red/runtime/lib/nodes/flows/util.js
+++ b/packages/node_modules/@node-red/runtime/lib/nodes/flows/util.js
@@ -19,6 +19,8 @@ var Log = require("@node-red/util").log;
 var subflowInstanceRE = /^subflow:(.+)$/;
 var typeRegistry = require("@node-red/registry");
 
+var envVarExcludes = {};
+
 function diffNodes(oldNode,newNode) {
     if (oldNode == null) {
         return true;
@@ -52,12 +54,8 @@ function mapEnvVarProperties(obj,prop,flow) {
     } else if (typeof obj[prop] === 'string') {
         if (obj[prop][0] === "$" && (EnvVarPropertyRE_old.test(v) || EnvVarPropertyRE.test(v)) ) {
             var envVar = v.substring(2,v.length-1);
-            if (!flow) {
-                obj[prop] = process.env.hasOwnProperty(envVar)?process.env[envVar]:v;
-            } else {
-                var r = flow.getSetting(envVar);
-                obj[prop] = r!==undefined?r:obj[prop];
-            }
+            var r = flow.getSetting(envVar);
+            obj[prop] = r!==undefined?r:obj[prop];
         }
     } else {
         for (var p in v) {
@@ -69,7 +67,15 @@ function mapEnvVarProperties(obj,prop,flow) {
 }
 
 module.exports = {
-
+    init: function(runtime) {
+        envVarExcludes = {};
+        if (runtime.settings.hasOwnProperty('envVarExcludes') && Array.isArray(runtime.settings.envVarExcludes)) {
+            runtime.settings.envVarExcludes.forEach(v => envVarExcludes[v] = true);
+        }
+    },
+    getEnvVar: function(k) {
+        return !envVarExcludes[k]?process.env[k]:undefined
+    },
     diffNodes: diffNodes,
     mapEnvVarProperties: mapEnvVarProperties,
 
diff --git a/test/unit/@node-red/runtime/lib/nodes/flows/util_spec.js b/test/unit/@node-red/runtime/lib/nodes/flows/util_spec.js
index 3c6598ffe..ac8efef79 100644
--- a/test/unit/@node-red/runtime/lib/nodes/flows/util_spec.js
+++ b/test/unit/@node-red/runtime/lib/nodes/flows/util_spec.js
@@ -50,7 +50,7 @@ describe('flows/util', function() {
             var foo = {a:"$(foo1)",b:"$(foo2)",c:{d:"$(foo3)"}};
             for (var p in foo) {
                 if (foo.hasOwnProperty(p)) {
-                    flowUtil.mapEnvVarProperties(foo,p);
+                    flowUtil.mapEnvVarProperties(foo,p,{getSetting: p => process.env[p]});
                 }
             }
             foo.should.eql({ a: 'bar1', b: 'bar2', c: { d: 'bar3' } } );
@@ -59,7 +59,7 @@ describe('flows/util', function() {
             var foo = {a:"${foo1}",b:"${foo2}",c:{d:"${foo3}"}};
             for (var p in foo) {
                 if (foo.hasOwnProperty(p)) {
-                    flowUtil.mapEnvVarProperties(foo,p);
+                    flowUtil.mapEnvVarProperties(foo,p,{getSetting: p => process.env[p]});
                 }
             }
             foo.should.eql({ a: 'bar1', b: 'bar2', c: { d: 'bar3' } } );
@@ -77,6 +77,27 @@ describe('flows/util', function() {
             foo.should.eql({ a: '$(unknown)', b: 'FOO2', c: { d: 'FOO3' } } );
         });
     });
+    describe('#getEnvVar',function() {
+        before(function() {
+            process.env.foo1 = "bar1";
+        })
+        after(function() {
+            delete process.env.foo1;
+        })
+        it('returns a known env var', function() {
+            flowUtil.init({settings:{}});
+            flowUtil.getEnvVar("foo1").should.equal("bar1")
+        })
+        it('returns undefined for an unknown env var', function() {
+            flowUtil.init({settings:{}});
+            (flowUtil.getEnvVar("foo2") === undefined).should.be.true()
+        })
+        it('returns undefined for an excluded env var', function() {
+            flowUtil.init({settings:{envVarExcludes:['foo1']}});
+            (flowUtil.getEnvVar("foo1") === undefined).should.be.true()
+        })
+
+    });
 
     describe('#diffNodes',function() {
         it('handles a null old node', function() {
diff --git a/test/unit/@node-red/runtime/lib/nodes/index_spec.js b/test/unit/@node-red/runtime/lib/nodes/index_spec.js
index 85eacf6f0..66958196a 100644
--- a/test/unit/@node-red/runtime/lib/nodes/index_spec.js
+++ b/test/unit/@node-red/runtime/lib/nodes/index_spec.js
@@ -31,17 +31,18 @@ describe("red/nodes/index", function() {
     before(function() {
         sinon.stub(index,"startFlows");
         process.env.NODE_RED_HOME = NR_TEST_UTILS.resolve("node-red");
+        process.env.foo="bar";
     });
     after(function() {
         index.startFlows.restore();
         delete process.env.NODE_RED_HOME;
+        delete process.env.foo;
     });
 
     afterEach(function() {
         index.clearRegistry();
     });
 
-    process.env.foo="bar";
     var testFlows = [{"type":"test","id":"tab1","label":"Sheet 1"}];
     var testCredentials = {"tab1":{"b":1, "c":"2", "d":"$(foo)"}};
     var storage = {
@@ -68,8 +69,8 @@ describe("red/nodes/index", function() {
     };
 
     function TestNode(n) {
+        this._flow = {getSetting: p => process.env[p]};
         index.createNode(this, n);
-        var node = this;
         this.on("log", function() {
             // do nothing
         });