These variables will be set to environment by the runner, and could be protected by exposing only to protected branches or tags, or some particular environments.
-else
%p
These variables will be set to environment by the runner, and could be protected by exposing only to protected branches or tags.
%p
So you can use them for passwords, secret keys or whatever you want.
%p
The value of the variable can be visible in job log if explicitly asked to do so.