I think all of these companies need to let you separate secrets from other env vars and not let you ever read your secrets once they're written down.