anchor.diff:  fi
   ```
   
  -You then upload the env file, encrypted, into the secrets bucket with the following command:
  +You then upload the `env` file, encrypted, into the secrets S3 bucket with the following command:
   
   ```bash
   # Upload the env
  
positive.code: # Managing Pipeline Secrets
  
  When you need to use secret values in your pipelines, there are some best practices you should follow to ensure they stay safely within your infrastructure, and are never stored in or sent to Buildkite.
  
  <%= toc %>
  
  
negative.code:   https://api.github.com/repos/my-org/my-app/deployments
  ```
  
  To set up the `GITHUB_MY_APP_DEPLOYMENT_ACCESS_TOKEN` secret for the step, you would create an `environment` [agent hook](/docs/agent/v3/hooks) on your agent machine to conditionally export it. For example:
  
  ```bash
  #!/bin/bash
  