path for secret.xml