moved sensitive info to local config