move secret keys into ENV variables

I suggest removing these two keys from your repository, regenerating new ones, and moving them into ENV variables. It looks like you are already using ENV variables to manage other keys, so I think this approach will work well for you.