auto-generate secret once instead of leaking it into the VCS