move secret to environment var