The secrets folder should be only user-readable.