Remove secrets from subprocess env I was just looking into a proposal to add more code complexity that could leak static secrets to/from env… and my agent found a bug in the existing code. 🙈