We can no longer edit the pipeline directly, but we can add stuff to `webpack.config.js` which is executed as a normal JS file, so we can access `$FLAG` with `process.env.flag`

The flag is filtered out again, I went probably overkill and copied a ROT13 function to obscure it:

```js
function cipherRot13(str) {
str = str.toUpperCase();
return str.replace(/[A-Z]/g, rot13);

function rot13(correspondance) {
const charCode = correspondance.charCodeAt();
//A = 65, Z = 90
return String.fromCharCode(
((charCode + 13) <= 90) ? charCode + 13
: (charCode + 13) % 90 + 64
);

}
}

console.log(cipherRot13(process.env.FLAG))

// rest of webpack.config.js
```

Reversing the ROT13, we get `punk_{7KN3O181O6W1A6XS}`.