or actually, we should change the secure env code to check the job `force_secure_env` first?