move secret to an env var