we should move the app secret out of the repo and into a ENV var