diff --git a/lib/http/SchemaResponse.js b/lib/http/SchemaResponse.js
index e9fad83..32ab126 100644
--- a/lib/http/SchemaResponse.js
+++ b/lib/http/SchemaResponse.js
@@ -5,17 +5,21 @@ class SchemaResponse {
     this.functionsRequest = functionsRequest;
     this.res = res;
     this.schemaName = schemaName;
-    this.protectedFields = config.responseProtectedFields;
+    this.allowedFields = config.responseAllowedFields;
   }
 
-  removeProtectedFields(data) {
-    for (const field of this.protectedFields) {
-      delete data[field];
-    };
-  };
+  removeNotAllowedFields(data) {
+    const { env } = data;
+    if(env && env.length){
+      const fieldsToRemove = Object.keys(env.filter(field => !this.allowedFields.includes(field)));
+      for (const field of fieldsToRemove) {
+        delete data.env[field];
+      }
+    }
+  }
 
   json(data) {
-    this.removeProtectedFields(data);
+    this.removeNotAllowedFields(data);
     const schemeAndAuthority = this.functionsRequest.schemeAndAuthority();
     this.res.set('Content-Type', `application/json; charset=utf-8; profile=${schemeAndAuthority}/_schemas/${this.schemaName}`);
     this.res.end(JSON.stringify(data));
diff --git a/lib/support/config.js b/lib/support/config.js
index ed56c79..97c7afe 100644
--- a/lib/support/config.js
+++ b/lib/support/config.js
@@ -22,7 +22,7 @@ module.exports = {
   defaultGlobalModules: ConfigDiscovery.getList('DEFAULT_GLOBAL_MODULES', DEFAULT_GLOBAL_MODULES),
   bodyParserLimit: process.env.BODY_PARSER_LIMIT || '1mb',
   redisConnectionTimeout: ConfigDiscovery.getInt('REDIS_CONNECTION_TIMEOUT', 2000),
-  responseProtectedFields: ConfigDiscovery.getList('RESPONSE_PROTECTED_FIELDS', ['env']),
+  responseAllowedFields: ConfigDiscovery.getList('RESPONSE_ALLOWED_FIELDS', ['BACKSTAGE_CLIENT_ID']),
   metric: {
     client: process.env.METRIC_CLIENT,
     udpHost: process.env.METRIC_UDP_HOST,
diff --git a/npm-shrinkwrap.json b/npm-shrinkwrap.json
index 21b40fa..dd30431 100644
--- a/npm-shrinkwrap.json
+++ b/npm-shrinkwrap.json
@@ -1,13 +1,13 @@
 {
   "name": "@globocom/backstage-functions",
-  "version": "0.4.1",
+  "version": "0.6.0-rc.3",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
     "@globocom/backstage-functions-sandbox": {
-      "version": "0.5.4-next.0",
-      "resolved": "https://artifactory.globoi.com:443/artifactory/api/npm/npm-local/@globocom/backstage-functions-sandbox/-/@globocom/backstage-functions-sandbox-0.5.4-next.0.tgz",
-      "integrity": "sha512-uXCzisk62rMkE9bBU5pilzL+pDd24EyHQ+dZEOFwUpaIzeKnrDwas5t70gAezW8jaMWTW3s/bkADu/NG4hEHFw==",
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/@globocom/backstage-functions-sandbox/-/backstage-functions-sandbox-0.5.3.tgz",
+      "integrity": "sha512-+KNd1bM0QoqZ4UufHKe8NlZbahlx7lrLODSyHKDPS0669vEiWT/kxoRB6c/epRJms/Mf6yncmRqxH8nmNq1tyA==",
       "requires": {
         "once": "^1.4.0",
         "stack-trace": "^0.0.9"
diff --git a/package.json b/package.json
index 2298e58..2cf28bb 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@globocom/backstage-functions",
-  "version": "0.4.1",
+  "version": "0.6.0-rc.4",
   "description": "Remote serverless code executor",
   "main": "index.js",
   "scripts": {
@@ -26,7 +26,7 @@
   "author": "Backstage Team <backstage@corp.globo.com>",
   "license": "MIT",
   "dependencies": {
-    "@globocom/backstage-functions-sandbox": "^0.5.4-next.0",
+    "@globocom/backstage-functions-sandbox": "^0.5.3",
     "@opentelemetry/api": "^0.18.1",
     "@opentelemetry/core": "^0.19.0",
     "@opentelemetry/exporter-collector-grpc": "^0.19.0",