How do we avoid putting this secret key in the source?