sensitive: PATH_REFERENCE_SECRET_CANARY