Secure env variables only available during 'script'?