hide sensitive stuff in env vars