add callout for branch env variables (#8177)

* add callout for branch env variables

* update callout location

Author: ykethan

src/pages/[platform]/deploy-and-host/fullstack-branching/secrets-and-vars/index.mdx

@@ -112,6 +112,12 @@ npx ampx sandbox secret remove foo
 
 ## Set environment variables
 
+<Callout warning>
+
+Note: do not store secret values in environment variables. Environment variables values are rendered in plaintext to the build artifacts and can be accessed by anyone with access to the build artifacts or [get-app](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/amplify/get-app.html) command.
+
+</Callout>
+
 Environment variables work like key-value pairs to help manage configurable settings across different deployment environments, including development, staging, and production. Unlike secrets, which store sensitive data, environment variables are typically nonconfidential and are used for controlling application behavior in different environments. Another key difference is that environment variables are stored and managed by the Amplify managed service. You can set environment variables in the Amplify console (view the [AWS Amplify Hosting User Guide](https://docs.aws.amazon.com/amplify/latest/userguide/environment-variables.html#setting-env-vars) for detailed instructions).
 
 <Video src="/images/gen2/secrets-and-vars/env-vars.mp4" description="Video - Secrets" />