don't expose secrets