secret should be a secret