Will environment variables specified with --secret-env-vars be redacted from all LLM-bound output in Copilot CLI?

[m-titov]

If I use the --secret-env-vars flag in Copilot CLI to specify sensitive environment variables (e.g., --secret-env-vars=MY_SECRET,DB_PASSWORD), will their values always be redacted from any output sent to the LLM, including command results (like ! env), logs, and error messages?

For example, if MY_SECRET=abc123 and a command prints abc123, will the LLM see [REDACTED] instead?

Are there any exceptions or cases where the secret value could leak?
Please provide detailed examples.