move secret to ENV_VAR, closes #9