make app secret invisible