Secrets

let token: Secret<String> = env("GITHUB_TOKEN")   // needs env ["GITHUB_TOKEN"]
log(token)         // does not compile
"{token}"          // does not compile

Secret<T> is not a subtype of T. It can be passed to an approved operation (send it in a header, compare it), but it cannot reach a log or a string by accident.