title: Is it safe to use GitLab CI «protected» variables for secrets?
body: <p>I haven't found any way to pass secret variables in GitLab CI pipelines except with so-called «protected» variables. Any other variables <strong>can be revealed by any committer</strong> as every commit/branch goes throw a pipeline and the code can be modified.</p>
  
  <p>I don't like protected variables because they are too complicated. I need to grant access to some variable to certain people like I do in SQL-databases or Linux filesystems. Instead, I have to make a protected variable, a protected branch, a protected environment (premium feature). And I have to add the maintainer permission level to some users. And then (maybe) they will the only people to access my secret variables.</p>
  
  <p>Also, I have no idea how are those variables stored. Usually, I use Hashicorp Vault and now GitLab is the weakest security point.</p>
  
  <p>Is it safe enough?
  Are there more reliable methods to keep secrets in CI pipelines?</p>