Build tasks has variables section. There you can mask a variable. The problem is that, for example in node process.env.masked_var is undefined. So what is the purpose of the masked env variables or how should I access them properly?
The purpose of the secret variables is that someone defines values (like credentials) that should not be visible in logs or to other editors of the build/release-definitions. You can use the secret variables like any other variable in the inputfields but secret variables won't be set as environment-variables for the process.
If you realy need to use secret variables as environment-variable you need to use the 'commandline' task and map that variable to a environmentvariable in the 'Environment variables'-section of the task