anchor.diff:  # Managing Pipeline Secrets
   
  -When you need to use secret values in your pipelines, there are some best practices you should follow to ensure they stay safely within your infrastructure, and are never stored in or sent to Buildkite.
  +When you need to use secret values in your pipelines, there are some best practices you should follow to ensure they stay safely within your infrastructure and are never stored in, or sent to, Buildkite.
   
   <%= toc %>
   
  
positive.code: fi
  ```
  
  You then upload the env file, encrypted, into the secrets bucket with the following command:
  
  ```bash
  # Upload the env
  
negative.code: 
  A best practice for secret storage is to use your own secrets storage service, such as [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) or [Hashicorp Vault](https://www.vaultproject.io).
  
  There are also various [Buildkite Plugins](/docs/pipelines/plugins) that integrate reading and exposing secrets to your build steps using secrets storage services.
  
  ## Storing secrets in environment hooks
  
  If you don’t use a secrets storage service, the recommended place to store secrets is in [agent environment hooks](/docs/agent/v3/hooks). Agent hooks are stored on your agent machine, are only accessible by you, and can conditionally expose secrets to your pipeline steps.
  
  For example, say you had the following deploy [command step](/docs/pipelines/command-step) in a pipeline:
  
  