The config field of the build section allows you set environment variables available to the build environment. Variables set in this section do not create runtime config vars. Also runtime config vars (e.g., those set with heroku config:set) are not available at build-time.
So how should I set secrets during build time safely (i.e. without committing them)?
Background: Rails + Webpacker + React app on Heroku in Docker, trying to get an API key to the client side.