> I would have expected them to filter anything that's in an env secret from the log output. Pretty sure Travis does this.

It does.