When env var is changed from private to public, we didn't nullify it, so someone doing that could miss exposing it. To minimise the risk of exposing any secure info we'll now nullify the value.
