Secret variables
A secret-typed variable is write-only, and none of the write mutations will overwrite one.
A variable typed secret never reads back its value, and the mutations
that write variables refuse to touch a secret row rather than risk
handing the value back.
A secret variable is write-only AND immutable
Once a row is secret, upsertEnv, renameEnv and saveSharedVar
refuse it, setAppEnv skips it, and importEnv counts it in
skippedSecrets instead of writing over it, a downgrade to plain
would have handed the stored value straight back on the next read.
Rotating one is delete + create, and no mutation turns a secret back into
a plain variable. The reverse (plain -> secret) is always allowed.
See also
Did this page help you?