Passing sensitive data to Sparrowdo scenario

default env

cat .env/vars.env

#!bash
export PASSWORD=secret
export TOKEN=12345

sparrowdo --host foo.bar.baz --tags token=.env[TOKEN],password=.env[PASSWORD]

Within sparrowdo scenario:

#!raku
say tags()<password>;
say tags()<token>;

override default for host foo.bar.baz

.env/host-vars-foo.bar.baz.env

#!bash
export PASSWORD=secret123
export TOKEN=FOOBAR

The cool thing is env file gets copied to a remote host and immediately gets removed after exporting to Raku/Sparrowdo scenario at the very beginning , so it's never kept on remote host