A deploy job needs passwords and API keys, but anything written in a workflow file is visible to everyone who can read the repo. Encrypted secrets let the pipeline use those values without storing them in code. Use them for every token, key or password, passed into a step through env. Do not rely on log masking as protection, and remember that pull requests from forks do not receive your secrets.