SECURE_ENV_VARS may be a string