A build requires a secret from OCI Vault. Which build specification feature should be evaluated instead of plaintext source variables?

1. A public repository file containing the secret.
2. Encoding the secret in the branch name.
3. Disabling authentication for the dependent service.
4. Vault-backed environment variables with the required secret permissions.