> I'm tempted to just throwing stuff like "AWS_KEY=" at the algorithm and see

Anybody tried? What does actually happen if you do this kind of thing? I can think of a few more obvious "script kiddie" ideas, but I won't post them here lest a copilot developer sees it and closes all the elementary stuff.