It’s possible to leak vars that are redacted from logs by uploading an interpolated pipeline that uses them.

The pipeline upload command could scan the received pipeline for any secret values and refuse to upload it if present, and print an error explaining why.