password and secret warnings only happen if a variable is assigned a string value (ie, PASSWORD = "something") rather than simply warning if a variable name contains PASSWORD