If a secret path is a subset of a second secret path, there's a risk that its secret is substituted for the matching part of the second path. To prevent this, use the sha256 of the paths as placeholder string instead.