Function is_secret 

pub fn is_secret(name: &str) -> bool

Whether a file name is one an export must never carry.

Named rather than enumerated: --tls-key, a per-actor key and a GitHub App PEM are all secrets that no list of literal file names would keep up with, so the rule is the shape of the name. auth is the one literal, being the bearer-token table.