Environment variables in canisters (ICP)

how can I inject an env variable secret inside a main net deployed canister?

And also how is my secret protected against everyone else on the chain?

Thx