secret now generated once at runtime