fix the non-functional security. change to use secret as first argument.