anchor.diff:  
   A best practice for secret storage is to use your own secrets storage service, such as [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) or [Hashicorp Vault](https://www.vaultproject.io).
   
  -There are various [Buildkite Plugins](/docs/pipelines/plugins) that integrate reading and exposing secrets to your build steps using secrets storage services.
  +There are also various [Buildkite Plugins](/docs/pipelines/plugins) that integrate reading and exposing secrets to your build steps using secrets storage services.
   
   ## Storing secrets in environment hooks
   
  -If you don’t use a secrets storage service, the recommended place to store secrets is in [agent environment hooks](/docs/agent/v3/hooks). Agent hooks are stored on your agent machine, are only accessible to you, and can conditionally expose secrets to your pipeline steps.
  +If you don’t use a secrets storage service, the recommended place to store secrets is in [agent environment hooks](/docs/agent/v3/hooks). Agent hooks are stored on your agent machine, are only accessible by you, and can conditionally expose secrets to your pipeline steps.
   
   For example, say you had the following deploy [command step](/docs/pipelines/command-step) in a pipeline:
   
  
positive.code: fi
  ```
  
  You then upload the env file, encrypted, into the secrets bucket with the following command:
  
  ```bash
  # Upload the env
  
negative.code: 
  ## Anti-pattern: Referencing secrets in your pipeline YAML
  
  You should never refer to secrets directly in your pipeline.yml file, as they may be interpolated during the [pipeline upload](/docs/agent/v3/cli-pipeline#uploading-pipelines) and sent to Buildkite. For example:
  
  ```yml
  steps:
  