Since circleCI users upload the private heroku SSH keys to automate deploys, how hard would it be for the intruders to get access to the environment variables s

Since circleCI users upload the private heroku SSH keys to automate deploys, how hard would it be for the intruders to get access to the environment variables stored in heroku?