> Spawns your subprocess with the resolved values injected into its environment

... So if the process is expecting a secret on stdin or in a command-line argument, I need to make a wrapper?