Visibility controls whether an environment variable value should be masked in generated documentation, .env examples, logs, and CLI output.

This is a hint to code generators and tooling about how to treat the value when displaying configuration information. The actual secret protection (encryption at rest, masking in memory) must be implemented by consuming code.

Default (unspecified) is treated as SECRET for safety.