add note about hashing the secret