Good point. You would need to inject the secrets in an inaccessible part of the pipeline, like an external proxy.