should we put this in cdo-secrets?