The problem is that things are harder than "publicly readable" or "not". For example, even if you have an internal CI server, you don't want to hide the environ

The problem is that things are harder than "publicly readable" or "not". For example, even if you have an internal CI server, you don't want to hide the environment variables... but you still don't want to show prod keys/tokens to every developer in your org. This is complicated by the fact that one often has to know env vars in order to debug the code, so you cannot just hide all the variables all the time. Having variable list is very helpful in things like logs and bug reports. We have this problem in our work and unfortunately there is no good solution. We do try to avoid secrets in the environment variables where possible, but sadly this does not always work. Life would be so much easier if no one would store secrets in variables... or if at least there was a reliable way to tell if environment variable is secret or not. But I think the former is more likely.