ensure secret key is outside of repo