Yes. It's that easy. Sometimes it's already done by a dev. Say in GitLab the CI is pretty good about never revealing env. variables to you once you set them, ho

Yes. It's that easy. Sometimes it's already done by a dev. Say in GitLab the CI is pretty good about never revealing env. variables to you once you set them, however devs for debugging purposes will do something like echo $SECRET_PASSWORD and the output will be in the job.