Add info on CI/CD variable encryption

doc/security/README.md

@@ -19,6 +19,7 @@ type: index
 - [Send email confirmation on sign-up](user_email_confirmation.md)
 - [Security of running jobs](https://docs.gitlab.com/runner/security/)
 - [Proxying images](asset_proxy.md)
+- [CI/CD environment variables](cicd_environment_variables.md)
 
 ## Securing your GitLab installation
 

doc/security/cicd_environment_variables.md

+---
+type: reference
+---
+
+# CI/CD Environment Variables
+
+Environment variables are applied to environments via the runner and can be set from the project's **Settings > CI/CD** page.
+
+The values are encrypted using [aes-256-cbc](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) and stored in the database.
+
+This data can only be decrypted with a valid [secrets file](../raketasks/backup_restore.md#when-the-secrets-file-is-lost).