We can no longer edit the pipeline directly, but we can add stuff to `webpack.config.js` which is executed as a normal JS file, so we can access `$FLAG` with `process.env.flag`
The flag is filtered out again, I went probably overkill and copied a ROT13 function to obscure it:
```jsfunction cipherRot13(str) {  str = str.toUpperCase();  return str.replace(/[A-Z]/g, rot13);
  function rot13(correspondance) {    const charCode = correspondance.charCodeAt();    //A = 65, Z = 90    return String.fromCharCode(            ((charCode + 13) <= 90) ? charCode + 13                                    : (charCode + 13) % 90 + 64           );
  }}
console.log(cipherRot13(process.env.FLAG))
// rest of webpack.config.js```
Reversing the ROT13, we get `punk_{7KN3O181O6W1A6XS}`.