If migrating your infrastructure to swarm is not feasible: - make sure to sanitize the environment before spawning any child processes. - Be sure to `set +x`

If migrating your infrastructure to swarm is not feasible: - make sure to sanitize the environment before spawning any child processes. - Be sure to `set +x` (or your shell's equivalent) in your CI process - that your secrets never get interpolated into a string through your scripting language.