Release pipelines store secrets as pipeline variables and agent command logging is enabled. What change will prevent the secrets' values from being written to the agent logs?

Storing secrets in environment variables is the correct approach because Azure DevOps automatically redacts (masks) environment variables marked as secret from agent logs. This prevents their values from being exposed in plain text within the logs, even if command logging is enabled. Passing secrets on the command line is insecure because command-line arguments are often visible in process lists and historical logs, making them easily discoverable. Applying a "secret" prefix to variable names is a convention for identification, but it doesn't inherently trigger redaction in logs; Azure DevOps requires explicit marking of variables as secret. Echoing secret values to the command line would directly print them to the logs, defeating any security measures.