anchor.diff:  ```
   
   <section class="Docs__note">
  -  <p>Use build scripts instead of <code>command</code> blocks, for steps that use secrets.</p>
  +  <p>Use build scripts instead of <code>command</code> blocks for steps that use secrets.</p>
   </section>
   
  -If you must define your script in your steps, you can prevent interpolation by using `$$`:
  +If you must define your script in your steps, you can prevent interpolation by using the `$$` syntax:
   
   ```yml
   steps:
  
positive.code: 
  ## Anti-pattern: Storing secrets in your pipeline.yml
  
  You should never store secrets in the <code>env</code> block at the top of your pipeline steps, whether it's in a pipeline.yml file or the [YAML Pipeline Steps (beta)](https://buildkite.com/changelog/32-defining-pipeline-build-steps-with-yaml).
  
  ```yml
  env:
    # Security risk! The the secret will be sent to and stored in Buildkite, and
    # be available in the "Uploaded Pipelines" list in the job’s Timeline tab.
    GITHUB_MY_APP_DEPLOYMENT_ACCESS_TOKEN: "bd0fa963610b..."
  
  
negative.code: # Managing Pipeline Secrets
  
  When you need to use secret values in your pipelines, there are some best practices you should follow to ensure they stay safely within your infrastructure and are never stored in, or sent to, Buildkite.
  
  <%= toc %>
  
  