How do you hide sensitive information held in variables on a docker-compose file
Use environment variables on your host that are read by your docker-compose.yml file.  There are a couple ways to accomplish this.  One way is to create a .env file on the host that contains your variables.  Docker Compose will read these variables and apply them to your configuration.

Alternatively, or in conjunction with a .env file, you can set environment variables in your shell.  These variables will be applied the same way as those read from a .env file and actually take precedence.

Read more here: https://docs.docker.com/compose/environment-variables/