Move secret token to yml file outside source control.
Ensure not redirecting outside domain.